> Markdown version of [/jobs/ext/4510010-information-security-compliance-manager](https://www.wearedevelopers.com/jobs/ext/4510010-information-security-compliance-manager). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Information Security & Compliance Manager - **Company:** CloudHQ LLC - **Location:** Ashburn, VA, United States - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** Microsoft Word, Microsoft Excel, Microsoft Outlook, Cyber Security, Information Technology Audit, Microsoft Office, Microsoft PowerPoint, RSA (Cryptosystem), Information Security Management System, RSA Archer Platform, ISO-14001, Servicenow - **Published:** November 1, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=a5d5525c654b9d8d ## About the Role * Minimum 7 years of demonstrated professional experience in Governance, Risk, and Compliance (GRC), cybersecurity compliance, IT audit, risk management, or closely related functions * Minimum 5 years of demonstrated hands-on experience with ISO 27001, SOC 1, SOC 2, and/or other recognized security, risk, or compliance frameworks * Minimum 5 years of demonstrated hands-on experience using GRC platforms such as OneTrust, Hyperproof, RSA Archer, ServiceNow GRC, AuditBoard, LogicGate, or comparable GRC solutions * Minimum 3 years of demonstrated experience managing or directly supervising GRC, information security, audit, compliance, or related professionals * Demonstrated experience leading, coaching, and developing team members, including assigning priorities, managing workload, reviewing deliverables, and supporting professional development * Demonstrated experience leading internal and external audits, certification activities, control assessments, risk assessments, and remediation programs * Experience managing relationships with internal and external auditors, process owners, control owners, technical teams, and other stakeholders * Experience managing risks, controls, assessments, findings, corrective actions, and compliance reporting * Experience developing and maintaining policies, standards, procedures, controls, risk documentation, and compliance evidence * Experience coordinating multiple compliance frameworks, audits, assessments, and remediation activities simultaneously * Advanced working knowledge of ISO 27001, SOC 1, SOC 2, and related control environments * Strong knowledge of GRC principles, information security risk management, control design and effectiveness, audit methodologies, corrective actions, and continual improvement * Strong experience with GRC platforms and the management of risk registers, control libraries, assessments, evidence, findings, remediation workflows, dashboards, and reporting * Demonstrated leadership and people-management skills, including coaching, prioritization, delegation, performance management, and team development * Ability to manage multiple audits, certifications, assessments, risks, and remediation activities across different business functions and locations * Ability to translate framework, audit, regulatory, and contractual requirements into practical controls and business processes * Understanding of privacy, data protection, and applicable legal and regulatory requirements * Knowledge of ISO 14001 and ISO 50001 is preferred; direct experience is a plus * Strong analytical and problem-solving skills with the ability to assess risk and recommend practical solutions * Strong project management, organizational, and prioritization skills * Strong written, verbal, and presentation skills, including the ability to communicate effectively with technical teams, process owners, auditors, and management * Ability to lead cross-functional compliance initiatives and drive timely completion of agreed remediation activities * Ability to exercise sound professional judgment and appropriately escalate significant risks or compliance concerns * Strong attention to documentation quality, evidence integrity, traceability, and audit readiness * Ability to operate effectively in a fast-paced and evolving environment * Proficiency with Microsoft Office applications, including Excel, Word, PowerPoint, Outlook, and Teams Our Ideal Candidate Will Also Possess * Bachelor's degree in a related field, preferred * Relevant professional certifications such as ISO 27001 Lead Auditor/Lead Implementer, CISA, CRISC, CISM, CISSP, or equivalent GRC or information security credentials are strongly preferred * ISO 14001 and ISO 50001 auditor credentials are also desirable ## Description The Information Security & Compliance Manager is responsible for managing CloudHQ's day-to-day Governance, Risk, and Compliance (GRC), information security, audit, and compliance activities. Reporting to the Director of Audit & Compliance, this role provides leadership and oversight to the Information Security & Compliance team, manages compliance activities across the organization, leads audits and assessments, oversees risks and controls, and drives remediation and continual improvement. The position supports CloudHQ's compliance with ISO 27001:2022, SOC 1, SOC 2, ISO 14001, ISO 50001, and other applicable frameworks, regulatory requirements, and organizational standards. What You Will Get To Do * Manage the day-to-day execution and continual improvement of CloudHQ's GRC, audit, information security compliance, and related programs * Provide direct management, guidance, coaching, and professional development to Information Security & Compliance Analysts * Assign and prioritize team activities, manage workload and deadlines, and review deliverables for quality, consistency, completeness, and audit readiness * Serve as the primary escalation point for the analyst team on complex GRC, audit, risk, control, and compliance matters * Manage and support CloudHQ's Information Security Management System (ISMS) and compliance with ISO 27001:2022, SOC 1, SOC 2, and other applicable security and compliance frameworks * Support the management and continual improvement of ISO 14001 and ISO 50001 programs, as applicable * Lead and coordinate internal and external audits, certifications, attestations, and assessments, including planning, evidence collection, stakeholder coordination, audit responses, findings, and remediation * Manage risk assessments, control assessments, internal audits, gap assessments, and compliance reviews * Work directly with business and technical process owners to evaluate controls, identify gaps and risks, and establish practical remediation plans * Manage audit findings, non-conformities, risks, corrective actions, and remediation activities through closure, escalating significant or overdue matters as appropriate * Oversee the administration, governance, and effective use of GRC platforms, including risk registers, control libraries, assessments, audit evidence, findings, remediation workflows, dashboards, and compliance reporting * Establish consistent and repeatable GRC processes, methodologies, workflows, documentation, and reporting across the organization * Lead the development, review, implementation, and maintenance of policies, standards, procedures, controls, and related compliance documentation * Coordinate documentation and evidence required to support certifications, attestations, customer requirements, internal and external audits, and regulatory obligations * Provide GRC, audit, risk, control, and compliance guidance to business and technical teams * Monitor changes to applicable standards, regulatory requirements, contractual obligations, and industry practices and coordinate necessary updates to compliance activities * Prepare and present compliance, risk, audit, findings, and remediation status to management and the ISO Steering Committee. * Support security and compliance awareness and training initiatives * Identify opportunities for automation, standardization, and process improvements that increase the efficiency, consistency, and effectiveness of GRC activities * Escalate significant compliance gaps, risks, control deficiencies, and unresolved remediation activities to the Director of Audit & Compliance