Sr GRC Analyst - ISO27001 Certification Lead (12-month contract)

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Sr GRC Analyst - ISO27001 Certification Lead (12-month contract) based in the United States. The Sr GRC Analyst will lead a major information security initiative, taking an established global technology organization through its first ISO/IEC 27001:2022 certification. This is a hands-on, fixed-term engagement focused on building and implementing a robust Information Security Management System (ISMS), from initial gap assessment through successful Stage 2 certification. Working closely with senior leadership and cross-functional teams, you will coordinate risk assessments, strengthen security controls, and establish reliable audit evidence. You will also leverage existing SOC 2 and PCI DSS frameworks to streamline implementation and avoid unnecessary duplication. Beyond achieving certification, you will develop internal capabilities and ensure a smooth transition to a sustainable, independently managed ISMS. Accountabilities You will take ownership of the day-to-day certification program, coordinating stakeholders, managing implementation activities, and ensuring the organization is fully prepared for its initial ISO 27001 audit. Your responsibilities will include: • Develop and manage the end-to-end ISO/IEC 27001:2022 certification program, including the project plan, timeline, milestones, and deliverables from gap assessment through Stage 2 audit. • Report progress, risks, key decisions, and required actions to the Senior Director of Information Security and executive sponsor. • Assess the existing security program against ISO/IEC 27001:2022 clauses 4–10 and Annex A, identifying gaps and opportunities to reuse existing SOC 2 and PCI DSS controls and evidence. • Facilitate agreement with leadership on ISMS scope, organizational context, interested parties, and information security objectives. • Design an ISMS risk assessment and treatment methodology aligned with the existing risk register. • Coordinate risk assessments and treatment activities with designated risk owners, ensuring that risk acceptance decisions are formally documented and approved by the accountable owners. • Develop and maintain essential ISMS documentation, including the Statement of Applicability, risk treatment plan, policies, and procedures. • Update existing policies and procedures where possible rather than introducing unnecessary parallel documentation. • Work with control owners to implement required controls, address identified gaps, and ensure controls operate consistently long enough to generate appropriate Stage 2 audit evidence. • Establish repeatable evidence collection processes within approved GRC tools, using authorized AI tools where appropriate and validating all generated outputs. • Deliver ISMS awareness sessions for employees and targeted briefings for leadership, risk owners, and control owners. • Coordinate an independent internal audit, ensuring it is conducted by someone other than the implementation lead. • Prepare and facilitate the ISMS management review with top management. • Support the selection of an accredited certification body and coordinate the Stage 1 and Stage 2 certification audits. • Lead responses to audit nonconformities, coordinate corrective action plans, and monitor their resolution. • Complete the certification engagement by transferring ISMS ownership to the designated internal owner, including all documentation, an annual operating calendar, and a readiness plan for the first surveillance audit. • Provide secondary support to the existing Information Security analyst on related GRC activities, including risk register maintenance, policy reviews, third-party security assessments, and customer security questionnaires, according to priorities agreed with the Senior Director of Information Security. • Coach and develop internal team members so they can independently operate and maintain the ISMS after the contract ends. Requirements The ideal candidate is an experienced information security and GRC professional with a proven track record of delivering ISO 27001 certifications. They should combine deep technical knowledge of security frameworks with strong program management, stakeholder engagement, and implementation skills. The following qualifications are required: • At least 7 years of experience in information security, risk, or compliance, including a minimum of 4 years in hands-on Governance, Risk, and Compliance (GRC) roles. • Bachelor's degree in Information Security, Information Systems, Business, or a related field, or equivalent practical experience. • Proven experience leading at least 2 organizations through initial ISO/IEC 27001 certification, including both Stage 1 and Stage 2 audits, with at least one certification based on the 2022 version. • Current ISO/IEC 27001 Lead Implementer certification. • In-depth working knowledge of ISO/IEC 27001:2022 and ISO/IEC 27002:2022, including ISMS scoping, risk assessment and treatment, Statement of Applicability development, internal audits, and management reviews. • Experience mapping ISO 27001 requirements to other frameworks, such as SOC 2, PCI DSS, and NIST Cybersecurity Framework (CSF), to maximize control and evidence reuse. • Experience working with accredited certification bodies and managing audit findings, nonconformities, and corrective action processes. • Demonstrated ability to develop, document, and implement practical policies, standards, and procedures that teams can effectively follow. • Strong program and project management capabilities, with a track record of delivering compliance initiatives within fixed timelines. • Excellent communication and stakeholder management skills, including the ability to influence without direct authority. • Ability to collaborate effectively with executives, engineering teams, and technical and non-technical stak