Compliance Manager

Trident Consulting is seeking a "Compliance Manager" for one of our clients in "Aliso Viejo, CA - Onsite" - a global leader in medical technology and pharmaceutical Industry.


Job Title: Compliance Manager
Location: Aliso Viejo, CA - Onsite
Type: W2 Contract
Rate: $86/Hr


Requirements: What You'll Do
NIST CSF Assessment & Roadmap

• Lead a current-state assessment of cybersecurity posture against the NIST CSF (v1.1 or v2.0) across all five Functions: Identify, Protect, Detect, Respond, and Recover.
• Establish a target maturity tier and define a prioritized, time-boxed roadmap with clear milestones within the six-month engagement window.
• Map existing controls (policies, procedures, technical safeguards) to CSF Categories and Subcategories; identify gaps and document residual risk.
• Where NIST CSF does not apply directly, leverage equivalent controls from NIST 800-53, ISO 27001, SOC 2, CMMC, or other applicable frameworks to provide crosswalk evidence. Program Governance & Project Management
• Establish and maintain a formal program charter, RACI matrix, and weekly status reporting cadence for all NIST CSF workstreams.
• Own the program plan - maintaining tasks, owners, dependencies, and milestone dates with rigorous tracking and proactive escalation of blockers.
• Manage the junior GRC contractor: assign work, review deliverables, provide structured feedback, and ensure quality and consistency across outputs.
• Run structured stakeholder meetings, produce clear meeting notes, action registers, and decision logs.
• Maintain a living program dashboard visible to CISO and senior leadership reflecting current maturity scores, risk posture, and roadmap status. Policy, Process & Control Development
• Draft, revise, and finalize cybersecurity policies, standards, procedures, and control narratives required to close CSF gaps.
• Design and implement repeatable processes for control execution - including access reviews, vulnerability management SLA tracking, patch governance, and control attestations.
• Develop evidence collection templates, control calendars, and checklists to support ongoing monitoring post-engagement.
• Build a governance repository (SharePoint, Confluence, or equivalent) organized for auditability and long-term operability. Risk Management
• Maintain a cybersecurity risk register aligned to CSF subcategories, capturing likelihood, impact, ownership, and remediation status.
• Facilitate risk assessment workshops with IT, Engineering, and Quality stakeholders; document findings and drive decisions to closure.
• Identify, document, and manage exceptions; develop compensating controls where remediation timelines extend beyond engagement scope. Stakeholder Engagement & Influence
• Operate as the primary point of accountability for all NIST CSF maturity activities, working without direct authority over functional teams.
• Build trusted relationships across IT, Engineering, Quality, Legal, and Regulatory Affairs to drive compliant outcomes.
• Communicate program status, risk posture, and decisions clearly to both technical and executive audiences.
• Deliver training or awareness content to stakeholders on relevant control expectations and their responsibilities. Transition & Knowledge Transfer
• Design all processes with handoff in mind: document workflows, runbooks, and control calendars sufficient for an internal team member to continue operating the program independently.
• Conduct formal knowledge transfer sessions in the final 30 days of the engagement.
• Produce a final engagement report summarizing maturity progress, residual gaps, and recommended next steps.

Required Experience

• 7+ years of experience in cybersecurity, GRC, or a closely related field.
• Demonstrated hands-on experience leading a NIST CSF assessment, gap analysis, or maturity improvement program - OR equivalent depth in NIST 800-53, ISO 27001, SOC 2, or CMMC with proven ability to apply crosswalk to NIST CSF.
• Strong project management skills: the ability to build and manage a formal program plan, track milestones, escalate risks, and deliver consistently on schedule.
• Proven track record of working autonomously in contractor or consulting roles with minimal supervision.
• Experience managing or mentoring junior team members and reviewing their work for quality.
• Demonstrated ability to build processes and documentation from scratch that are designed to outlast the builder's tenure.
• Experience producing executive-facing reporting (dashboards, risk summaries, status decks).
• Strong written communication skills - policies, procedures, and program documentation must be clear, concise, and audit-ready.

Preferred Qualifications

• Prior engagement in a regulated industry (medical device, pharma, financial services, defense) where compliance rigor and documentation standards are high.
• Familiarity with the NIST CSF v2.0 update and its new Govern function.
• Experience with GRC platforms (ServiceNow GRC, Archer, Drata, Vanta, or similar).
• Relevant certifications: CISM, CRISC, CGRC/CAP, CISSP, ISO 27001 Lead Implementer, or equivalent.
• Familiarity with FDA cybersecurity guidance in the context of medical device GRC (a plus, not a requirement). Working Style Requirements
• Must be able to operate as a self-starter - define the work, not just execute it.
• Must demonstrate structured thinking: organized, methodical, detail-oriented with an eye for process quality.
• Must be comfortable with ambiguity and building structure in environments where it does not yet fully exist.
• Must communicate proactively - surfacing issues, seeking alignment, and keeping stakeholders informed without being prompted.

About Trident Consulting
Trident Consulting is an award-winning staffing and consulting firm headquartered in San Ramon, CA. Since 2005, we've partnered with Fortune 500 and high-growth companies to deliver high-quality talent across technology, engineering, business operations, and professional services.


We specialize in contract, contract-to-hire, and direct hire placements, supporting roles across IT, data & analytics, cloud, cybersecurity, finance & accounting, HR, operations, and more. With a strong focus on hard-to-fill and niche positions, our global recruiting engine enables us to deliver speed, quality, and scale.