Job Description:
• Lead and support customer security audits, responding to security questionnaires and demonstrating compliance with security frameworks
• Prepare, coordinate, and manage ISO 27001 audits, including evidence collection, control implementation, and auditor engagement
• Ensure ongoing compliance with HIPAA, NIST CSF, and other healthcare data security requirements
• Develop and maintain policies, procedures, and security documentation
• Perform gap analyses and risk assessments to identify and remediate compliance risks
• Manage and improve security governance frameworks
• Conduct third-party vendor risk assessments
• Monitor security controls for effectiveness and continuous improvement
• Support security awareness training initiatives
• Stay current on ISO 27001, HIPAA, NIST 800-53, and other relevant standards, translating them into actionable controls
• Assist in defining security metrics and reporting compliance status and risk posture to leadership
• Collaborate with legal, security, IT, and business teams to align compliance requirements with security operations
Requirements:
• Bachelor's degree in Information Security, Computer Science, Risk Management, or related field, or equivalent experience
• Minimum 8+ years of progressive experience in GRC, compliance, or security audit roles
• Experience in healthcare or regulated industries strongly preferred
• Certifications strongly preferred: ISO 27001 Lead Auditor/Implementer, CISSP, CISM, CISA, HITRUST CCSFP, or CRISC
• Experience leading ISO 27001, SOC 2, or HITRUST audits, including ISMS implementation and external audit coordination
• Strong understanding of NIST CSF, SOC 2, GDPR, and other security frameworks
• Hands-on experience with customer security audits, security questionnaires, and security assessments
• Ability to perform risk assessments, policy reviews, and compliance gap analyses
• Strong written and verbal communication skills, including explaining technical concepts to non-technical stakeholders
• Excellent organizational and project management skills
• Ability to work independently and collaboratively in a remote environment
• Familiarity with GRC tools such as OneTrust, LogicGate, Archer, Vanta, or Drata is a plus
• OneStudyTeam is unable to sponsor work visas at this time
Benefits:
• Expected pay range of $110,000–$140,000 USD per year for full-time team members
• Remote work environment
• Professional Employer Organization support for non-U.S. resident applicants
• Diversity and nondiscrimination commitment