Jobs › ISO/IEC 27001
ISO/IEC 27001 (Information Security) Jobs
ISO/IEC 27001 is the international standard for an information security management system, the global benchmark for infosec certification.
ISO/IEC 27001 is the world's most widely recognized standard for an Information Security Management System (ISMS). Most recently revised in 2022, it specifies how an organization establishes, operates, and continually improves a risk-based system of security controls, and it is certifiable, so companies use it to prove their security posture to customers and regulators across borders. Where SOC 2 is the dominant attestation in North America, ISO 27001 is the certification most often required internationally.
It is also the template for the newer management-system standards: ISO/IEC 42001 for AI was deliberately built to align with it, so an ISO 27001 program is frequently the foundation a company extends into AI and privacy governance. Roles that require it want people who can build and run an ISMS, manage the control set, and carry an organization through certification and surveillance audits.
ISO/IEC 27001: Frequently Asked Questions
What is ISO/IEC 27001?
It is the international standard for an Information Security Management System (ISMS), specifying a risk-based set of requirements that an organization can be independently certified against.
What is the difference between ISO 27001 and SOC 2?
ISO 27001 is a certifiable international standard for a security management system. SOC 2 is an AICPA attestation report common in North America. Many companies pursue both for different markets.
Is ISO 27001 certification required?
It is voluntary, but it is frequently required by international customers and partners and is often the practical baseline for doing business in many markets.
Open ISO/IEC 27001 GRC jobs (82)
GRC Engineer
Divisional Risk and Control Specialist, VP
Consulting Associate/Cybersecurity & Incident Response (Forensic Services practice)
Associate Principal/Cybersecurity & Incident Response (Forensic Services practice)
Client Assurance Analyst (Security Questionnaires)
Senior GRC Engineer
Senior Security Analyst
Associate/Cybersecurity & Incident Response (Forensic Services practice)
Associate Principal/Cybersecurity & Incident Response (Forensic Services practice)
Security Engineer, Corporate Security
Security Engineer
Consulting Associate/Cybersecurity & Incident Response (Forensic Services practice)
Senior Security Engineer - End-User, Infrastructure & AI Security
Lead Senior Security Engineer (Enterprise AI Platform)
Technical Program Manager, SOX Compliance
GRC Engineer
GRC Manager
Director of Security Assurance & Trust
Director of Security Assurance & Trust
Director of Internal Audit
Head of Enterprise Risk Management
Director, Governance Risk & Compliance
Senior Compliance Program Manager, GRC
GRC Engineer
Compliance Manager
Senior Compliance Analyst, Governance Programs
Product Manager, Enterprise Privacy
Security-Compliance Program Manager
Security GRC Program Manager, Third Party Risk
Security Risk & Compliance, Agent Security
Security Audit & Controls, Security GRC
Third-Party Risk Management (TPRM) Risk Analyst
Staff Security Governance Engineer, Policies & Standards
Senior GRC Specialist
Supplier Security & Assurance, Security GRC
GRC Manager
Analyst, IT Governance, Risk, and Compliance
GRC, Data Privacy & Technical Cybersecurity SME - Senior Manager
Technology and Security Risk Director
IT Risk Manager, BT Risk Management
IT Auditor
Security Risk & Compliance, Data Centers & Compute
Sr. GRC Engineer
Senior Engineering Manager, SDET - Okta Identity Governance (OIG)
Third Party Risk Management Lead
Director of Cybersecurity Programs & Sector Engagement
Senior Director, GRC
Lead Security Compliance Engineer
GRC Principal - Data Privacy and Security
Associate General Counsel, Privacy – Remote (USA) (993-SLS)
Senior Risk Analyst
Senior Risk & Governance Engineer
Compliance Engineering Lead
DORA Governance & TPRM Specialist
Senior Risk Associate
Staff Identity Governance and Access Engineer
ICT Risk Analyst
Staff Software Engineer, AI and Data Risk
Corporate Risk and Compliance - Associate II
Vendor Risk Manager
Staff Software Engineer, AI and Data Risk
Director of Product, Governance & Compliance
Lead, Security Controls Assurance - SOX
Information Security Controls Manager - Cloud & AI Governance
Subject Matter Expert, GTM GRC - V4G
Security & AI Governance Lead
Senior Third-Party Risk Specialist
Security Compliance Specialist
GRC Pre-Sales Consultant / Solutions Engineer – EMEA
GRC Program Manager, Audit & Controls
Risk Services - Cyber Security Audit, Experienced/Senior Associate
Operational Resilience Manager
Internal Audit Manager
ICT Risk Oversight Lead
Senior Manager, Information Compliance, AI Governance & Privacy
Governance, Risk & Compliance Analyst
Virtual CISO & Cybersecurity Practice Lead
Director of Governance, Risk & Compliance (GRC)
Director, Compliance & AI Governance
Governance, Risk & Compliance (GRC) Analyst
Sr Manager, Governance, Risk, Compliance & Privacy
Security Engineer, GRC
ISO/IEC 27001 jobs: what the market looks like right now
A snapshot built from the 82 ISO/IEC 27001 roles currently on this page.
What these roles pay by level
| Level | Median midpoint | Postings |
|---|---|---|
| Mid-level | $255k | 7 |
| Senior / lead / manager | $155k | 13 |
| Director | $235k | 5 |
How these figures were calculated, and sources
Primary source: our own board. Every figure above is the median midpoint of the salary ranges published in the live postings on this page. Nothing is estimated, modeled, or carried over from a previous month. It is recalculated each time the board refreshes.
What is included. Only postings that publish a salary range. Hourly, weekly and monthly rates are annualised (2,080 hours, 52 weeks, 12 months). Ranges below $20,000 a year are excluded as data-entry placeholders. A seniority band is shown only when at least five postings support it; executive / c-suite is present on this page but below that threshold, so no median is published for that band.
What this is not. These are advertised ranges, not accepted offers. Advertised ranges tend to run wider than what is actually paid, and roles that do not publish a range are missing from the calculation entirely, which can bias the result upward.
For an independent benchmark, compare against the U.S. Bureau of Labor Statistics Occupational Employment and Wage Statistics for SOC 13-1041 — Compliance Officers, published annually at bls.gov/oes. BLS reports actual wages across all employers rather than advertised ranges, so its medians normally sit below job-board figures.
Where the work is
- Work mode: 15 remote, 1 hybrid, 66 on-site or unstated.
- Seniority mix: senior (39), mid (30), director (10), executive (3)
- Employers hiring more than one: Anthropic (7), Charles River Associates (5), Vanta (5), AlphaSense (3), Okta (3), Collibra (2)
Skills these postings ask for
- board and committee reporting
- policy lifecycle ownership
- risk appetite and tolerance setting
- three-lines-of-defense operating models
- ISO/IEC 42001 and NIST AI RMF fluency
How to get a governance job — the full career guide for this field: entry routes, transferable backgrounds, certifications and salary by level.
Certifications that come up most
None of these are universally required, but they appear often enough in ISO/IEC 27001 postings to be worth knowing: CGEIT, CRISC, AIGP, CISA. The certification academy covers what each one actually tests and who it is for.
Hiring for ISO/IEC 27001?
We have 82 open ISO/IEC 27001 roles on the board right now. Reach candidates who are already searching for this role, not a general audience. Your posting appears on this page, in the job alerts, and across the GRC Careers network.
Post a job Pricing from $99 · About GRC Careers · Hiring toolkit
All GRC jobs · Job alerts