Senior Compliance Specialist

Job not on LinkedIn

🔥 14 minutes ago

🇺🇸 United States – Remote

⏰ Full Time

🟠 Senior

🚔 Compliance

👻 Ghost score 13%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Mechanical Orchard

WebsiteLinkedInAll Job Openings

11 - 50 employees

💼 Consulting

📦 Logistics

📣 Marketing

💰 $2M Seed Round on 2022-10

Consulting • Logistics • Marketing

Mechanical Orchard is an AI-native technology company that specializes in modernizing legacy systems and software. Their innovative approach involves using AI-enhanced tools to reinvent and operate critical business applications, particularly those on mainframes, with minimal risk. They leverage an iterative process of reverse-engineering and replication to progressively modernize and move applications to the cloud, maintaining system stability while enabling innovation. As leaders in legacy modernization, Mechanical Orchard helps companies adapt to market changes quickly and efficiently, ensuring their systems are future-proof.

📋 Description

• Own the day-to-day operation and continuous improvement of ISO 27001, SOC 2, and GDPR compliance programs. • Maintain program scope, track compliance obligations, schedule reviews, maintain documentation, and ensure audit readiness. • Inspect systems and workflows, assess control effectiveness, and collect and validate evidence from CSPs and internal systems. • Lead the internal audit program, including planning and conducting audits, documenting findings, and verifying corrective actions. • Lead pursuit of CMMC certification, agency-specific ATOs, NIST SP 800-171, and other federal and defense requirements. • Define scope, assess controls, identify gaps, drive remediation, identify applicable STIGs, and maintain SSPs, POA&Ms, and authorization documentation. • Lead enterprise risk management, chair risk committee meetings, maintain the risk register, and facilitate risk assessments and treatment actions. • Develop and maintain security and compliance policies, procedures, and control documentation. • Lead external audits and compliance assessments as primary contact for auditors and assessors. • Oversee vendor and third-party security risk reviews. • Serve as the organization’s DPO and advise on privacy compliance, DPIAs, data subject requests, and supervisory-authority communications. • Support customer security and compliance due diligence for federal and defense opportunities. • Oversee security awareness and compliance training programs. • Own and optimize Vanta compliance tooling, integrations, monitoring, and evidence collection workflows. • Drive recurring control activities, including access reviews, incident response exercises, and business continuity and recovery tests. • Report compliance status, audit findings, remediation progress, and certification readiness to leadership.

🎯 Requirements

• 5+ years of experience in GRC, information security compliance, or audit, including direct ownership of security compliance programs and remediation efforts. • Proven experience obtaining and maintaining agency-specific ATOs, including preparing authorization packages, addressing assessment findings, and managing ongoing compliance and continuous monitoring requirements. • Hands-on experience administering Vanta or a comparable GRC platform, including configuring scope, control mappings, integrations, and automated evidence collection. • Ability to directly inspect cloud configurations, IAM, logging, and operational workflows; collect and validate evidence from source systems; and assess control design and operating effectiveness. • Demonstrated experience leading SOC 2 examinations and/or ISO 27001 certification audits from scoping and readiness through completion and remediation of findings. • Strong working knowledge of CMMC, NIST SP 800-171, RMF, and applicable STIGs, including translating requirements into controls, evidence, and remediation actions. • Strong knowledge of GDPR and CPRA, with practical experience advising on privacy compliance, maintaining processing records, and supporting DPIAs and data subject requests. • Degree in information security, computer science, information systems, or a related field, or equivalent practical experience. • Relevant professional certifications such as CCA, CCP, CRISC, CISM, or CISSP are preferred. • Prior experience as an ISSM or ISSO is strongly preferred.