SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Mechanical Orchard is seeking a Senior Compliance Specialist to own and drive the company's comprehensive compliance and governance programs. This is a strategic individual contributor role responsible for day-to-day operations and continuous improvement of ISO 27001, SOC 2, and GDPR compliance programs, including maintaining program scope, tracking obligations, scheduling reviews, maintaining documentation, and ensuring audit readiness.
Key responsibilities include leading the internal audit program (planning, conducting audits, documenting findings, verifying corrective actions); driving pursuit of CMMC certification and agency-specific ATOs with NIST SP 800-171 compliance; leading enterprise risk management including chairing risk committee meetings and maintaining the risk register; developing and maintaining security and compliance policies and control documentation; leading external audits and compliance assessments as primary auditor contact; overseeing vendor and third-party security risk reviews; serving as the organization's Data Protection Officer (DPO) with privacy compliance advisory duties; supporting customer security and compliance due diligence for federal and defense opportunities; overseeing security awareness and compliance training programs; owning and optimizing compliance tooling (Vanta); driving recurring compliance control activities (access reviews, incident response exercises, business continuity tests); and reporting compliance status and remediation progress to leadership.
The role requires direct inspection of cloud configurations, IAM, logging, and operational workflows; collection and validation of evidence from source systems; and assessment of control design and operating effectiveness. You will work cross-functionally with InfoSec, Legal, Sales, and technical teams to translate compliance requirements into actionable controls and remediation efforts.
Mechanical Orchard specializes in safely rewriting critical and complex business applications to enable rapid adaptation to market challenges. The company is built on principles of craft, expertise, Agile practices, test-driven development, and continuous improvement, with values centered on doing the right thing, doing what works, and being kind.
Qualifications and Requirements:
- 5+ years of experience in GRC, information security compliance, or audit, including direct ownership of security compliance programs and remediation efforts
- Proven experience obtaining and maintaining agency-specific ATOs, including preparing authorization packages, addressing assessment findings, and managing ongoing compliance and continuous monitoring requirements; prior experience as an ISSM or ISSO strongly preferred
- Hands-on experience administering Vanta or comparable GRC platform, including configuring scope, control mappings, integrations, and automated evidence collection
- Ability to directly inspect cloud configurations, IAM, logging, and operational workflows; collect and validate evidence from source systems; and assess control design and operating effectiveness
- Demonstrated experience leading SOC 2 examinations and/or ISO 27001 certification audits from scoping and readiness through completion and remediation of findings
- Strong working knowledge of CMMC, NIST SP 800-171, RMF, and applicable STIGs, including translating requirements into controls, evidence, and remediation actions
- Strong knowledge of GDPR and CPRA, with practical experience advising on privacy compliance, maintaining processing records, and supporting DPIAs and data subject requests
- Degree in information security, computer science, information systems, or related field, or equivalent practical experience
- Relevant professional certifications such as CCA, CCP, CRISC, CISM, or CISSP preferred
