Security Compliance Program Lead

About the Engagement

We're pursuing SOC 2 Type II and ISO 27001 certification concurrently, on a fixed schedule, and need someone to take the program from kickoff to a clean report/certificate — then hand off a running program to an internal owner.

Two dates anchor the engagement and do not move: the ISO 27001 certificate in March 2027 and the SOC 2 Type II report in May 2027. There's no slack before January, so month one is spent locking auditor commitments, not writing documents.

This is a hands-on individual contributor role, not a supervisory one. You'll write the policies, chase the evidence, and sit in the audit meetings yourself — working across engineering, IT, HR, legal, and field operations, none of whom report to you. The work runs on influence and follow-through, not authority.

Key Deliverables
-ISMS scope statement and SOC 2 system description — Due Nov 2026 / Jan 2027
-Risk assessment (ISO 27001 clause 6.1) + risk treatment plan — Due Dec 2026
-Approved policy set (~20 policies, Annex A structure) — Due Nov 2026
-Statement of Applicability, all 93 Annex A controls — Due Dec 2026
-Compliance platform configured and collecting evidence — Due Nov 2026
-Remediation complete and evidenced across all teams — Due Dec 2026
-Vendor risk register, third-party reports, signed DPAs — Due Dec 2026
-Penetration test commissioned; critical findings closed — Due Dec 2026
-ISMS internal audit and management review documented — Due Dec 2026
-SOC 2 Type I report issued — Due Jan 2027
-ISO 27001 certificate issued — Due Mar 2027
-SOC 2 Type II report issued, no material exceptions — Due May 2027
-Handover pack + trained internal owner — Due Jun 2027

What You'll Do
-Own the program plan, schedule, and budget; report progress to leadership monthly
-Contract and manage the CPA firm and certification body — scheduling, evidence requests, walkthroughs, findings/responses
-Define and document one scope boundary serving both frameworks
-Write the policies, Statement of Applicability, and system description
-Drive cross-team remediation (access control, logging, encryption, change management, onboarding/offboarding), holding owners to dates and escalating early
-Administer the compliance automation platform and keep evidence collection running
-Run vendor risk reviews; collect third-party reports and DPAs
-Coordinate the penetration test, internal audit, and management review
-Document the running program and train the internal owner who takes it on

Requirements

Required
-Has personally taken a SOC 2 or ISO 27001 engagement through to a clean report/certificate — as the owner, not a contributor
-3+ years in security compliance, GRC, IT audit, or closely related field
-Working knowledge of core security controls: IAM, MFA, logging & monitoring, encryption, endpoint management, change management
-Clear, plain writing — policies, system description, and audit responses are most of the output
-Able to hold people to commitments without line authority
-Available to start in October 2026, with a fixed end date

Preferred
-Has run both frameworks together, or mapped one control set across two
-Hands-on with a compliance automation platform (Vanta, Drata, Secureframe, Sprinto, or similar)
-Background in IT services, managed services, or field services (environments with subcontractors/technician access to customer systems)
-CISA, CISM, ISO 27001 Lead Implementer or Lead Auditor certification

Terms
-Structure: Open to independent contractor or fixed-term employment, whichever the candidate prefers
-Commitment: Full time; October 2026–February 2027 is the heaviest build sprint, pace eases once audits are underway
-Completion: Engagement ends when the Type II report is issued and handover is complete; an extension into the ongoing program may be offered but is not guaranteed to either party
-Milestone structure (contractors): A portion of fee may be tied to deliverables #10, #11, and #12 — terms to be agreed

How to Apply

Please submit:
-A summary of a SOC 2 or ISO 27001 engagement you personally owned end-to-end, and the outcome
-Relevant certifications (CISA, CISM, ISO 27001 Lead Implementer/Auditor), if any
-Your availability for an October 2026 start