Remote opportunity at
Mechanical OrchardSenior Compliance Specialist
Mechanical Orchard specializes in modernizing critical business applications to help them adapt to market challenges while eliminating common project disruptions and risks. The organization applies agile…
Career Tools
About This Role
Mechanical Orchard specializes in modernizing critical business applications to help them adapt to market challenges while eliminating common project disruptions and risks. The organization applies agile engineering principles, pragmatic artificial intelligence, and cross-functional collaboration to transform how companies innovate and operate. Mechanical Orchard is currently seeking a hands-on Senior Compliance Specialist to manage and expand its compliance portfolio. This position suits an experienced governance, risk, and compliance professional who can…
Job Description
Mechanical Orchard specializes in modernizing critical business applications to help them adapt to market challenges while eliminating common project disruptions and risks. The organization applies agile engineering principles, pragmatic artificial intelligence, and cross-functional collaboration to transform how companies innovate and operate.
Mechanical Orchard is currently seeking a hands-on Senior Compliance Specialist to manage and expand its compliance portfolio. This position suits an experienced governance, risk, and compliance professional who can oversee existing frameworks and drive new certifications and authorizations.
In this capacity, the practitioner will maintain programs such as SOC 2, ISO 27001, GDPR, and CPRA, while also directing efforts toward new targets including CMMC, NIST SP 800-171, and US federal agency-specific Authority to Operate requirements. The role involves direct inspection of workflows and cloud configurations, leading internal and external audits, overseeing enterprise risk management, managing third-party vendor security reviews, and functioning as the organization's Data Protection Officer. Additionally, the specialist will optimize compliance tooling like Vanta and guide customer security due diligence for defense and federal opportunities.
Responsibilities
- Manage daily operations and continuous enhancement for ISO 27001, SOC 2, and GDPR compliance efforts
- Examine systems directly, evaluate control performance, and gather validation evidence from internal environments and cloud service providers
- Direct the internal audit schedule by planning assessments, recording findings, and overseeing corrective actions
- Drive the pursuit of CMMC certification, NIST SP 800-171 alignment, and agency-specific ATO authorizations
- Identify security technical implementation guides, evaluate configurations, and collaborate with technical personnel on remediation
- Produce and update system security plans, plans of action and milestones, and authorization documents
- Direct the enterprise risk management framework by chairing committee meetings and maintaining the risk register
- Create and update security and compliance policies while working with teams to verify alignment with operational practices
- Manage external audits and compliance reviews as the primary liaison for assessors
- Supervise third-party and vendor security risk evaluations and track remediation commitments
- Fulfill duties as the organization's Data Protection Officer to advise on privacy compliance and handle data subject inquiries
- Assist with federal and defense customer security due diligence and review proposed compliance obligations
- Direct security awareness training initiatives and ensure role-specific education is delivered for defense-related personnel
- Administer and improve compliance automation tooling, specifically Vanta, to manage control mappings and evidence collection
- Direct recurring compliance operations including access reviews, incident response drills, and business continuity tests
- Deliver compliance metrics, audit outcomes, and certification readiness updates to leadership
Requirements
- At least 5 years of professional background in information security compliance, audit, or governance and risk management
- Direct history of securing and maintaining agency-specific ATOs and managing continuous monitoring duties
- Hands-on expertise administering Vanta or a comparable GRC platform for scope configuration and automated evidence collection
- Capability to inspect cloud configurations, identity and access management, logging, and operational workflows directly
- Direct experience guiding SOC 2 examinations and ISO 27001 certification audits through completion
- Working knowledge of CMMC, NIST SP 800-171, RMF, and applicable security technical implementation guides
- Practical background in GDPR and CPRA privacy compliance, maintaining processing records, and supporting data protection impact assessments
Qualifications
- Prior background working as an Information System Security Manager or Information System Security Officer
- A degree in computer science, information systems, information security, or an equivalent technical field
- Professional credentials such as CCA, CCP, CRISC, CISM, or CISSP
Core Skills
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
What is the remote work policy for this role?
The source posting specifies that the role is remote.
What is the employment type?
The employment type is full-time.
What is the salary for this position?
The job posting does not specify the salary.
What experience is required to apply?
Candidates must have five or more years of experience in GRC, information security compliance, or audit, along with direct ownership of security compliance programs and remediation efforts.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.