DescriptionAbout the Role: Ampere Computing's Information Security team is expanding its security compliance and risk governance program to support the company's growth and evolving customer requirements. The Security Compliance Specialist will play a central, hands-on role in establishing, operationalizing, and maturing our Information Security Management System (ISMS).
Reporting to the Sr. Director, Information Security, you will own day-to-day compliance operations-including ISMS scoping, control design, control testing, evidence repository management, and audit readiness. In this role, you will partner with cross-functional control owners to track and facilitate the lifecycle of policies, procedures, and SOPs, facilitate Security Steering Committee governance rhythms, and manage both customer security assurance inquiries and Third-Party Risk Management (TPRM) assessments. You will collaborate closely with Engineering, Enterprise IT, Legal, HR, and Operations to embed sustainable security controls across our semiconductor design, cloud, and enterprise environments, while maintaining alignment with NIST security frameworks.
What You'll Achieve: - Advance ISO 27001 Alignment & ISMS Governance: Manage ISMS scoping, risk assessments, Statement of Applicability (SoA), internal readiness reviews, and coordinating external auditor and assessor engagements.
- Control Design, Testing & Evidence Collection: Partner with IT, Engineering, and business owners to ensure controls are designed effectively and consistently enforced. Establish testing cycles, validate operational effectiveness, and maintain an organized audit evidence repository.
- Governance Rhythms & Executive Reporting: Prepare working papers, risk profiles, and control health metrics for regular Security Steering Committee and ISMS governance meetings; track remediation actions through resolution.
- Policy & Documentation Lifecycle Governance: Partner with IT, Engineering, and corporate control owners to coordinate and track the lifecycle of Information Security policies, procedures, and Standard Operating Procedures (SOPs). Ensure documents are reviewed and updated on schedule, properly approved, version-controlled, and archived in centralized repositories.
- Third-Party Risk Management (TPRM) & Customer Assurance: Drive vendor security evaluations, review third-party risk questionnaires and SOC reports, identify supply-chain risks, and respond to incoming customer-facing security questionnaires and assurance inquiries.
- Security Framework Alignment & Cross-Functional Support: Maintain and map Ampere's internal security controls against NIST standards (e.g., CSF, SP 800-53, SP 800-171) alongside ISO 27001. Serve as an Information Security liaison to partner teams (such as Finance, Operations, and Product), assisting with security control evidence for SOX ITGC or advising on security intersections with broader corporate standards as needed.
- Remediation & Corrective Action Tracking: Identify compliance gaps and non-conformities, partner with technical owners to formulate practical corrective action plans, and track remediation milestones through closure in Jira.
About You: - Bachelor's degree in Information Security, Computer Science, Information Systems, Business, Auditing, or equivalent practical experience.
- Minimum 8 years of dedicated experience in information security compliance, IT audit, or risk management, with substantial time focused on ISO 27001 implementation and maintenance.
- Demonstrated ISO 27001 Experience: Direct, hands-on experience guiding an organization through the ISO/IEC 27001 implementation lifecycle, internal audits, and readiness assessments.
- Control & Audit Mindset: Strong understanding of control design, testing of design (TOD), testing of operating effectiveness (TOE), and audit evidence collection standards.
- Technical Audit Literacy: Comfortable evaluating access controls, audit logging, segregation of duties, and configuration baselines across enterprise technologies-including Microsoft Entra ID, ERP systems, Cloud environments (AWS, Azure, or OCI), and source code management platforms (GitHub / GitLab)-from an audit and compliance lens (no direct administrative scripting or configuration required).
- TPRM & Customer Assurance: Solid track record conducting third-party vendor risk assessments and responding to customer security questionnaires.
- Tooling Proficiency: Experience utilizing GRC, documentation, and workflow platforms such as Jira, Confluence, Workiva, Drata, or Vanta to automate evidence collection and manage compliance records.
- Collaborative Communicator: Ability to translate complex compliance requirements into clear, practical guidance for hardware/silicon engineers, software developers, and corporate stakeholders without creating unnecessary friction.
- High Attention to Detail: Rigorous approach to record-keeping, version control, and audit trail maintenance.
Preferred Qualifications: - ISO/IEC 27001 Lead Implementer certification (ISO 27001 Lead Auditor, CISA, or CRISC also valued).
- Hands-on experience with NIST frameworks (CSF, SP 800-53, SP 800-171) and SOX IT General Controls (ITGC).
- Familiarity or exposure to semiconductor/automotive quality and cybersecurity standards (such as ISO 9001, ISO 26262, or ISO/SAE 21434).
What We'll Offer: At Ampere we believe in taking care of our employees and providing a competitive total rewards package that includes base pay, cash long-term incentive, and comprehensive benefits. The full base pay range for this role is between $182,000 and $273,000.
Our benefits include health, wellness, and financial programs that support employees through every stage of life.
Benefit highlights include:
- Premium medical insurance, dental insurance, vision insurance, as well as income protection and a 401K retirement plan, so that you can feel secure in your health and financial future.
- Unlimited Flextime and 10+ paid holidays so that you can embrace a healthy work-life balance.
- A variety of healthy snacks, energizing espresso, and refreshing drinks to keep you fueled and focused throughout the day.
And there is much more than compensation and benefits. At Ampere, we foster an inclusive culture that empowers our employees to do more and grow more. We are excited to share more about our career opportunities with you through the interview process.
#LI-Hybrid
We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.
