Senior Compliance Specialist

At Mechanical Orchard, we specialize in safely rewriting the most critical and complex business applications—the software that runs the world as we know it today—so they’re ready to adapt quickly and easily to market challenges and opportunities. Our approach emerged from observing the decades-long failure patterns in modernization efforts and is designed to eliminate the risks and disruptions that characterize most projects.

Our background in software development and the impact on the industry is well known: we've literally helped write the book on XP and other impactful Agile practices. We’re applying the same thoughtfulness and rigor in applying AI pragmatically where it helps. We believe in the durable principles behind Agile, and embrace the power of cross-functional teams, collective ownership, test driven development, short feedback loops, and continuous improvement.

We’re bringing joy to beleaguered IT teams everywhere. Together, we’re seeing how applying craft, expertise, and technologies we’re building can fundamentally transform the way companies operate, innovate, and win. Our values are: Do the right thing. Do what works. Be kind.

Responsibilities
Own the day-to-day operation and continuous improvement of our ISO 27001, SOC 2, and GDPR compliance programs, including maintaining program scope, tracking compliance obligations, scheduling required reviews, maintaining documentation, and ensuring audit readiness. Directly inspect systems and workflows, assess control effectiveness, and collect and validate evidence from CSPs and internal systems. Lead the internal audit program, including planning and conducting audits, documenting findings, and verifying corrective actions, while ensuring auditor objectivity and independence. Lead our pursuit of CMMC certification, agency-specific ATOs, and compliance with applicable NIST SP 800-171 and other federal and defense requirements. Define scope, assess existing controls, identify gaps, and drive remediation through assessment and authorization readiness. Identify applicable STIGs, assess configurations and supporting evidence, and work with technical teams to implement and verify required changes. Develop and maintain SSPs, POA&Ms, and supporting assessment and authorization documentation. Lead our enterprise risk management program, including chairing risk committee meetings, maintaining the risk register, and facilitating assessment of security, compliance, and other business risks. Work with risk owners to define and track treatment actions, verify mitigation evidence, and bring decisions requiring risk acceptance or prioritization to leadership. Develop and maintain security and compliance policies, procedures, and control documentation, and drive policy review and approval. Work with relevant teams to verify that documentation reflects actual systems and practices, identify gaps between policy and implementation, and drive updates as requirements and business needs evolve. Lead external audits and compliance assessments, serving as the primary contact for auditors and assessors. Prepare and validate evidence submissions, explain control implementation, resolve assessment questions, and drive findings through remediation and verified closure. Oversee the vendor and third-party security risk review process, maintaining assessment criteria and ensuring reviews are completed and documented by the responsible teams. Track identified risks and remediation commitments, and escalate issues requiring risk acceptance or further action. Serve as the organization’s DPO, advising on and monitoring privacy compliance in partnership with Legal and relevant teams. Maintain processing records, review data handling and retention practices, advise on DPIAs, coordinate responses to data subject requests, track remediation of privacy compliance gaps, and serve as the contact for supervisory authorities. Support customer security and compliance due diligence, particularly for federal and defense opportunities. Contribute responses and evidence for requirements involving CMMC, NIST SP 800-171, and other applicable frameworks, and help evaluate proposed compliance commitments in partnership with InfoSec, Sales, and Legal. Oversee the security awareness and compliance training program, ensuring content reflects applicable requirements, company policies, and employee responsibilities. Work with responsible teams to ensure training is delivered, completion and effectiveness are tracked, and evidence is maintained, including role-specific training for personnel supporting federal and defense work. Own and optimize our compliance tooling, currently Vanta, including configuring program scope, control mappings, integrations with CSPs and internal systems, and evidence collection workflows. Investigate and resolve integration and monitoring issues, validate collected evidence against source systems, and improve automation to reduce manual effort and ensure our tooling accurately reflects day-to-day compliance status. Own and drive recurring compliance control activities, including access reviews, incident response exercises, and business continuity and recovery tests. Work with responsible teams to ensure activities are completed, validate supporting evidence, and track resulting findings through remediation. Report compliance status, audit findings, remediation progress, and certification readiness to leadership. Highlight material gaps, upcoming obligations, and decisions or resources needed to keep existing programs effective and advance new compliance objectives.

Qualifications and Skills
5+ years of experience in GRC, information security compliance, or audit, including direct ownership of security compliance programs and remediation efforts. Proven experience obtaining and maintaining agency-specific ATOs, including preparing authorization packages, addressing assessment findings, and managing ongoing compliance and continuous monitoring requirements. Prior experience as an ISSM or ISSO is strongly preferred. Hands-on experience administering Vanta or a comparable GRC platform, including configuring scope, control mappings, integrations, and automated evidence collection. Ability to directly inspect cloud configurations, IAM, logging, and operational workflows; collect and validate evidence from source systems; and assess control design and operating effectiveness. Demonstrated experience leading SOC 2 examinations and/or ISO 27001 certification audits from scoping and readiness through completion and remediation of findings. Strong working knowledge of CMMC, NIST SP 800-171, RMF, and applicable STIGs, including translating requirements into controls, evidence, and remediation actions. Strong knowledge of GDPR and CPRA, with practical experience advising on privacy compliance, maintaining processing records, and supporting DPIAs and data subject requests. Degree in information security, computer science, information systems, or a related field, or equivalent practical experience. Relevant professional certifications, such as CCA, CCP, CRISC, CISM, or CISSP, are preferred.

Mechanical Orchard, Inc. is an Equal Opportunity Employer and Prohibits Discrimination and Harassment of Any Kind. Mechanical Orchard, Inc. is committed to the principle of equal employment opportunity for all employees and to providing employees with a work environment free of discrimination and harassment. All employment decisions at Mechanical Orchard, Inc. are based on business needs, job requirements and individual qualifications, without regard to race, color, religion or belief, national, social or ethnic origin, sex (including pregnancy), age, physical, mental or sensory disability, HIV Status, sexual orientation, gender identity and/or expression, marital, civil union or domestic partnership status, past or present military service, family medical history or genetic information, family or parental status, or any other status protected by the laws or regulations in the locations where we operate. Mechanical Orchard, Inc. will not tolerate discrimination or harassment based on any of these characteristics. Mechanical Orchard, Inc. encourages applicants of all ages. Mechanical Orchard, Inc. will provide reasonable accommodation to employees who have protected disabilities consistent with local law.

We look forward to reviewing your application. Thanks!