Security Compliance Manager

OneStudyTeam

1d • Remote

About The Position

The Security Compliance Manager leads the organization’s security compliance and assurance efforts—ensuring we meet and maintain certification requirements (e.g., ISO 27001, SOC 2) and always remain audit-ready. This role translates security control requirements into actionable work across teams, drives evidence collection and remediation, and strengthens risk management practices to enable growth in regulated environments.

Requirements

• Experience leading a successful ISO 27001 or SOC 2 certification effort.
• 5+ years in a dedicated information security role in a regulated environment (e.g., HIPAA, GLBA, PCI).
• Demonstrated ability to lead ISO 27001 and/or SOC 2 certification efforts and ongoing maintenance activities.
• Strong competency in gap analysis and risk assessment methodologies; able to translate results into prioritized remediation plans.
• Working knowledge of security policy, procedure, and enforcement across key domains: access control, data classification, change management, asset management, BCDR, incident response, vulnerability management, secure SDLC, source control, endpoint protection.
• Ability to translate security/compliance requirements into actionable work for Engineering/IT/Operations (tickets, owners, acceptance criteria, evidence).
• Strong written and verbal communication—able to interface with all levels of the organization and produce high-quality audit-ready documentation.
• Technical foundation sufficient to understand high-level concepts related to public cloud (AWS/GCP/Azure), Agile SDLC, CI/CD, VPNs, and modern web applications.
• This role requires 100% of work to be performed in a remote office environment and requires the ability to use keyboards and other computer equipment.
• As a condition of employment, you will abide by all organizational security and privacy policies.

Nice To Haves

• Security certification such as CISA, CISM, CISSP (or similar).

Responsibilities

• Lead security certification & audit readiness (ISO 27001 / SOC 2): Drive quarterly ISO control requirements, manage ISO surveillance audits, lead SOC 2 examination readiness, and oversee ongoing maintenance activities once achieved.
• Operate the ISMS controls program: Manage internal ISMS control reviews, coordinate remediation and corrective actions, and ensure controls remain effective and scalable as the organization changes.
• Evidence management & auditor response: Prepare for internal and external audits by organizing requests, gathering evidence, maintaining audit artifacts, and authoring clear, consistent responses to auditors.
• Risk management program execution: Recommend and implement improvements to the information security risk management program; develop and maintain the risk register, risk ownership, and workflows for tracking remediation plans to closure.
• Metrics, reporting, and stakeholder enablement: Partner with Security leadership to define and report KRIs/KPIs for the information security program; support consistent responses to customer security audits and questionnaires aligned to program commitments.
• Manage periodic reviews and updates of security policies and procedures to ensure alignment with certifications, business needs, and regulatory expectations.
• Partner with an outsourced/internal audit function to validate control performance and drive continuous improvement.
• Support cross-functional education and adoption of security requirements by translating compliance language into clear tasks, owners, and acceptance criteria.

Benefits

• We value diversity and believe the unique contributions each of us brings drives our success. We do not discriminate on the basis of race, sex, religion, color, national origin, gender identity, age, marital status, veteran status, or disability status.
• Note: OneStudyTeam is unable to sponsor work visas at this time. If you are a non-U.S. resident applicant, please note that OneStudyTeam works with a Professional Employer Organization.
• This organization participates in E-Verify (E-Verify's Right to Work guidance can be found here).

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed