[Hiring] Senior Compliance Specialist @Mechanical Orchard

Role Description

Mechanical Orchard is looking for a hands-on GRC expert to take our compliance portfolio to the next level. You will maintain and strengthen our existing compliance programs covering SOC 2, ISO 27001, GDPR, and CPRA, and lead the pursuit of new compliance requirements, certifications, and authorizations, including US federal and DoW compliance: CMMC, NIST SP 800-171, and agency-specific ATOs.

• Own the day-to-day operation and continuous improvement of our ISO 27001, SOC 2, and GDPR compliance programs.
• Directly inspect systems and workflows, assess control effectiveness, and collect and validate evidence from CSPs and internal systems.
• Lead the internal audit program, including planning and conducting audits, documenting findings, and verifying corrective actions.
• Lead our pursuit of CMMC certification, agency-specific ATOs, and compliance with applicable NIST SP 800-171 and other federal and defense requirements.
• Develop and maintain security and compliance policies, procedures, and control documentation.
• Lead external audits and compliance assessments, serving as the primary contact for auditors and assessors.
• Oversee the vendor and third-party security risk review process.
• Serve as the organization’s DPO, advising on and monitoring privacy compliance.
• Support customer security and compliance due diligence, particularly for federal and defense opportunities.
• Oversee the security awareness and compliance training program.
• Own and optimize our compliance tooling, currently Vanta.
• Own and drive recurring compliance control activities.
• Report compliance status, audit findings, remediation progress, and certification readiness to leadership.

Qualifications

• 5+ years of experience in GRC, information security compliance, or audit.
• Proven experience obtaining and maintaining agency-specific ATOs.
• Hands-on experience administering Vanta or a comparable GRC platform.
• Ability to directly inspect cloud configurations, IAM, logging, and operational workflows.
• Demonstrated experience leading SOC 2 examinations and/or ISO 27001 certification audits.
• Strong working knowledge of CMMC, NIST SP 800-171, RMF, and applicable STIGs.
• Strong knowledge of GDPR and CPRA.
• Degree in information security, computer science, information systems, or a related field.
• Relevant professional certifications, such as CCA, CCP, CRISC, CISM, or CISSP, are preferred.

Requirements

• Direct ownership of security compliance programs and remediation efforts.
• Experience preparing authorization packages and managing ongoing compliance.
• Ability to assess control design and operating effectiveness.
• Experience advising on privacy compliance and supporting DPIAs.

Benefits

• Competitive salary and benefits package.
• Opportunities for professional development and growth.
• Flexible work environment.

Company Description

Mechanical Orchard specializes in safely rewriting critical and complex business applications to adapt quickly to market challenges and opportunities. Our values are: Do the right thing. Do what works. Be kind.