At Mechanical Orchard, we specialize in safely rewriting the most critical and complex business applications—the software that runs the world as we know it today—so they’re ready to adapt quickly and easily to market challenges and opportunities. Our approach emerged from observing the decades-long failure patterns in modernization efforts and is designed to eliminate the risks and disruptions that characterize most projects.
Our background in software development and the impact on the industry is well known: we've literally helped write the book on XP and other impactful Agile practices. We’re applying the same thoughtfulness and rigor in applying AI pragmatically where it helps. We believe in the durable principles behind Agile, and embrace the power of cross-functional teams, collective ownership, test driven development, short feedback loops, and continuous improvement.
We’re bringing joy to beleaguered IT teams everywhere. Together, we’re seeing how applying craft, expertise, and technologies we’re building can fundamentally transform the way companies operate, innovate, and win. Our values are: Do the right thing. Do what works. Be kind.
Mechanical Orchard is looking for a hands-on GRC expert to take our compliance portfolio to the next level. You will maintain and strengthen our existing compliance programs covering SOC 2, ISO 27001, GDPR, and CPRA, and lead the pursuit of new compliance requirements, certifications, and authorizations, including US federal and DoW compliance: CMMC, NIST SP 800-171, and agency-specific ATOs.
Responsibilities
Own the day-to-day operation and continuous improvement of our ISO 27001, SOC 2, and GDPR compliance programs, including maintaining program scope, tracking compliance obligations, scheduling required reviews, maintaining documentation, and ensuring audit readiness. Directly inspect systems and workflows, assess control effectiveness, and collect and validate evidence from CSPs and internal systems.
Lead the internal audit program, including planning and conducting audits, documenting findings, and verifying corrective actions, while ensuring auditor objectivity and independence.
Lead our pursuit of CMMC certification, agency-specific ATOs, and compliance with applicable NIST SP 800-171 and other federal and defense requirements. Define scope, assess existing controls, identify gaps, and drive remediation through assessment and authorization readiness. Identify applicable STIGs, assess configurations and supporting evidence, and work with technical teams to implement and verify required changes. Develop and maintain SSPs, POA&Ms, and supporting assessment and authorization documentation.
Lead our enterprise risk management program, including chairing risk committee meetings, maintaining the risk register, and facilitating assessment of security, compliance, and other business risks. Work with risk owners to define and track treatment actions, verify mitigation evidence, and bring decisions requiring risk acceptance or prioritization to leadership.
Develop and maintain security and compliance policies, procedures, and control documentation, and drive policy review and approval. Work with relevant teams to verify that documentation reflects actual systems and practices, identify gaps between policy and implementation, and drive updates as requirements and business needs evolve.
Lead external audits and compliance assessments, serving as the primary contact for auditors and assessors. Prepare and validate evidence submissions, explain control implementation, resolve assessment questions, and drive findings through remediation and verified closure.
Oversee the vendor and third-party security risk review process, maintaining assessment criteria and ensuring reviews are completed and documented by the responsible teams. Track identified risks and remediation commitments, and escalate issues requiring risk acceptance or further action.
Serve as the organization’s DPO, advising on and monitoring privacy compliance in partnership with Legal and relevant teams. Maintain processing records, review data handling and retention practices, advise on DPIAs, coordinate responses to data subject requests, track remediation of privacy compliance gaps, and serve as the contact for supervisory authorities.
Support customer security and compliance due diligence, particularly for federal and defense opportunities. Contribute responses and evidence for requirements involving CMMC, NIST SP 800-171, and other applicable frameworks, and help evaluate proposed compliance commitments in partnership with InfoSec, Sales, and Legal.
Oversee the security awareness and compliance training program, ensuring content reflects applicable requirements, company policies, and employee responsibilities. Work with responsible teams to ensure training is delivered, completion and effectiveness are tracked, and evidence is maintained, including role-specific training for personnel supporting federal and defense work.
Own and optimize our compliance tooling, currently Vanta, including configuring program scope, control mappings, integrations with CSPs and internal systems, and evidence collection workflows. Investigate and resolve integration and monitoring issues, validate collected evidence against source systems, and improve automation to reduce manual effort and ensure our tooling accurately reflects day-to-day compliance status.
Own and drive recurring compliance control activities, including access reviews, incident response exercises, and business continuity and recovery tests. Work with responsible teams to ensure activities are completed, validate supporting evidence, and track resulting findings through remediation.
Report compliance status, audit findings, remediation progress, and certification readiness to leadership. Highlight material gaps, upcoming obligations, and decisions or resources needed to keep existing programs effective and advance new compliance objectives.
Qualifications and Skills
5+ years of experience in GRC, information security compliance, or audit, including direct ownership of security compliance programs and remediation efforts.
Proven experience obtaining and maintaining agency-specific ATOs, including preparing authorization packages, addressing assessment findings, and managing ongoing compliance and continuous monitoring requirements. Prior experience as an ISSM or ISSO is strongly preferred.
Hands-on experience administering Vanta or a comparable GRC platform, including configuring scope, control mappings, integrations, and automated evidence collection.
Ability to directly inspect cloud configurations, IAM, logging, and operational workflows; collect and validate evidence from source systems; and assess control design and operating effectiveness.
Demonstrated experience leading SOC 2 examinations and/or ISO 27001 certification audits from scoping and readiness through completion and remediation of findings.
Strong working knowledge of CMMC, NIST SP 800-171, RMF, and applicable STIGs, including translating requirements into controls, evidence, and remediation actions.
Strong knowledge of GDPR and CPRA, with practical experience advising on privacy compliance, maintaining processing records, and supporting DPIAs and data subject requests.
Degree in information security, computer science, information systems, or a related field, or equivalent practical experience.
Relevant professional certifications, such as CCA, CCP, CRISC, CISM, or CISSP, are preferred.
A note on recruitment fraud
We have been made aware of scams in which people impersonate Mechanical Orchard to send fake job offers, interview invitations, and recruitment messages. Some use the name "Mechanical Orchard Staffing," which is not a company we operate. Some include our real office address to appear legitimate. We are not affiliated with these messages in any way.
Here is how to recognize a real message from us:
- All communication from our team comes from an @mechanical-orchard.com email address. We do not use any other domain.
- Every open role is listed on our Careers page. If a role is not posted here, we are not hiring for it.
- We never request a Social Security number, bank account details, or government ID before a signed offer and formal onboarding.
- We never ask candidates to make a payment, deposit a check, or purchase equipment at any stage of our process.
If you receive a message using our name and something feels off, do not reply to it and do not click its links. You can forward it to security@mechanical-orchard.com so our team can look into it.
Mechanical Orchard, Inc. is an Equal Opportunity Employer and Prohibits Discrimination and Harassment of Any Kind. Mechanical Orchard, Inc. is committed to the principle of equal employment opportunity for all employees and to providing employees with a work environment free of discrimination and harassment. All employment decisions at Mechanical Orchard, Inc. are based on business needs, job requirements and individual qualifications, without regard to race, color, religion or belief, national, social or ethnic origin, sex (including pregnancy), age, physical, mental or sensory disability, HIV Status, sexual orientation, gender identity and/or expression, marital, civil union or domestic partnership status, past or present military service, family medical history or genetic information, family or parental status, or any other status protected by the laws or regulations in the locations where we operate. Mechanical Orchard, Inc. will not tolerate discrimination or harassment based on any of these characteristics. Mechanical Orchard, Inc. encourages applicants of all ages. Mechanical Orchard, Inc. will provide reasonable accommodation to employees who have protected disabilities consistent with local law.
We look forward to reviewing your application. Thanks!
