Example Company
Software engineer
- Location
- San Francisco
- Type
- Full time
- Compensation
- $150k-$200k
- Posted
- 2 days ago
Join a team building useful software. Work closely with engineering and design to turn new ideas into products.
Loading job details
Sr GRC Analyst - ISO27001 Certification Lead (12-month contract)
- Type
- Full time
- Posted
- 2H AGO
About the role
Ready to lead TrueCommerce to its first ISO 27001 certification? Come help protect a global supply chain technology company and the thousands of customers who depend on it.
We are seeking an experienced ISO 27001 Implementation Lead for a fixed-term contract of approximately 12 months. You will plan, build, and take TrueCommerce’s Information Security Management System (ISMS) through initial ISO/IEC 27001:2022 certification. The engagement is complete when the certificate is issued and the ISMS has been handed over to an internal owner who can run it without external support.
Reporting to the Sr Director of Information Security, you will run the certification program day to day, working with leadership, risk owners, TechOps, Engineering, Legal, HR, and our InfoSec team. Leadership and named risk owners remain accountable for the ISMS and for accepting risk; you will design the approach, drive the work, and make sure the evidence holds up at audit. Where it fits alongside the certification work, you will also support and coach our existing InfoSec analyst on related GRC activities.
This is a remote, fixed-term contract open to candidates based in the United States. The expected rate for this engagement is [$X–$Y per hour], depending on experience and engagement model (for example, W-2 through a staffing partner or a direct statement of work).
What You'll Do:
Certification delivery (primary focus)
- Program plan: Build and run the certification plan, timeline, and milestones from gap assessment through the Stage 2 audit, and report progress, risks, and decisions needed to the Sr Director of Information Security and the executive sponsor.
- Gap assessment: Assess the current security program against ISO/IEC 27001:2022 clauses 4–10 and Annex A, reusing existing SOC 2 and PCI DSS controls and evidence wherever they already meet the requirement.
- Scope and context: Facilitate leadership agreement on ISMS scope, organizational context, interested parties, and information security objectives.
- Risk assessment and treatment: Design the ISMS risk methodology, aligned with the existing risk register, and run risk assessment and treatment with named risk owners, including formal risk acceptance by those owners.
- Statement of Applicability and documentation: Produce the Statement of Applicability, risk treatment plan, and required ISMS documentation, updating existing policies and procedures rather than creating parallel ones.
- Control implementation: Work with control owners to close gaps, and make sure controls operate long enough to produce the evidence auditors will expect at Stage 2.
- Evidence and tooling: Set up repeatable evidence collection in our GRC tooling, using corporate-approved AI tools where they add speed, with appropriate validation.
- Awareness: Deliver ISMS awareness for staff and targeted briefings for leadership, risk owners, and control owners.
- Internal audit and management review: Coordinate an independent internal audit, performed by someone other than the implementation lead, and prepare and facilitate the management review with top management.
- Certification audits: Support selection of an accredited certification body, coordinate the Stage 1 and Stage 2 audits, and lead responses to nonconformities and corrective action plans.
- Handover: Transfer full ownership of the ISMS to the designated internal ISMS owner, including documentation, an annual operating calendar, and a readiness plan for the first surveillance audit.
GRC team support (secondary, as capacity allows)
- Analyst support: Support the existing InfoSec analyst on GRC activities that overlap with the ISMS, such as risk register upkeep, policy reviews, third-party security assessments, and customer security questionnaires, with priorities agreed with the Sr Director of Information Security.
- Capability building: Coach the internal team on running the ISMS day to day, so certification builds lasting internal capability rather than dependence on the contractor.
Requirements for Success:
- At least seven years of experience in information security, risk, or compliance, including at least four years in hands-on GRC roles.
- Bachelor’s degree in information security, information systems, business, or a related field, or equivalent practical experience.
- Led at least two organizations through initial ISO/IEC 27001 certification (Stage 1 and Stage 2) as the implementation lead, including at least one against the 2022 version.
- Current ISO/IEC 27001 Lead Implementer certification.
- Deep working knowledge of ISO/IEC 27001:2022 and ISO/IEC 27002:2022, including ISMS scoping, risk assessment and treatment, the Statement of Applicability, internal audit, and management review.
- Experience mapping ISO 27001 to other frameworks such as SOC 2, PCI DSS, and NIST CSF so that controls and evidence are reused rather than duplicated.
- Experience working with accredited certification bodies, including responding to audit findings and nonconformities.
- Experience writing and rolling out policies, standards, and procedures that teams can follow in practice.
- Strong program management skills, with a track record of delivering fixed-timeline compliance projects.
- Ability to influence without authority and to work effectively with executives, engineers, and non-technical stakeholders.
- Preferred: ISO/IEC 27001 Lead Auditor, CISA, CISM, CRISC, or CGRC.
- Preferred: Experience in a SaaS, B2B platform, or supply chain technology environment.
- Preferred: Hands-on experience with GRC tooling and AI-assisted techniques for evidence collection and documentation.
- Preferred: Familiarity with privacy and data protection requirements (e.g., GDPR, CCPA) and how they map to ISO 27001 controls.
- Preferred: Experience mentoring or developing junior GRC or security staff.
Perks & Benefits
- Remote first and casual work environment
- 401k with 3.5% company match and vested after 2 years
- 20 PTO days - 10 company holidays - 1 birthday day off - 1 Volunteer day - 3 summer days
- Medical, dental, vision and other life/health insurance plans
- Paid parental leave
- Wellness reimbursement program
Who is TrueCommerce?
TrueCommerce is a high-performing global supply chain network that delivers fully integrated, end-to-end supply chain visibility and management. We help some of the world’s leading brands improve supply chain performance, including Schneider Electric, DanoneWave, Siemens, Ocean Spray, and many others.
For additional information, visit our website.
Applicants must be authorized to work for any employer in the U.S. At this time, we are unable to sponsor or take over sponsorship of an employment visa for this role.
Equal Opportunity EmployerThis employer is required to notify all applicants of their rights pursuant to federal employment laws. For further information, please review the Know Your Rights notice from the Department of Labor.
Travel
Travel required: No
Similar roles
Security GRC Analyst, Mergers & AcquisitionsKraken · Remote
IT GRC Analyst (PCI INTERNAL SECURITY ASSESSOR)-HYBRIDState Farm
Cyber Security AnalystHuman Security · New York
2027 Intern- Security EngineerBehance · Bucharest
Director, OT SecurityRiot Platforms
Security Officer in TrainingTexas A&M University, Nanostructured Materials Lab