ISO 27001: the roles you need to get certified

A customer wants an ISO 27001 certificate before signing, a tender requires one, or leadership simply wants to structure security. The same question comes up fast: who is going to carry the project? This guide sets out the roles a certification really needs, when each one comes in, and which of them deserve a hire rather than a one-off engagement.

What ISO 27001 certification really requires

ISO/IEC 27001 sets out the requirements for an information security management system (ISMS). It does not tell you which tools to deploy. It asks the organisation to define a scope, analyse its risks, choose controls to treat them, apply those controls and prove that it keeps improving over time.

In practice, the project produces and maintains:

A clear scope: which activities, sites and systems are covered.
A risk assessment and a treatment plan approved by management.
A statement of applicability justifying, control by control, what is applied or excluded (Annex A of the 2022 version lists 93 controls).
Policies and procedures that teams genuinely use.
Evidence: access reviews, tested backups, patch management, awareness, supplier follow-up.
An internal audit and a management review, both required by the standard before the certification audit.

The certification audit itself, run by a certification body, has two stages: a documentation review, then an on-site audit. The certificate is then kept through regular surveillance audits. That last point is the one many companies underestimate: certification is not a project, it is a permanent way of working.

The roles you cannot skip

No organisation needs one hire per role. Every role does need a named owner, though, or the project stalls.

Role	Job in the project	Internal or external
Executive sponsor	Sets the scope, arbitrates risks, approves resources and the management review	Always internal
ISMS manager	Runs the project, owns the plan, coordinates teams, carries the system after the audit	Internal, ideally
GRC analyst or consultant	Risk assessment, statement of applicability, documentation, evidence collection	Internal, external or both
Technical owners	Implement controls: access, backups, logging, cloud, endpoints	Internal (or a managed provider, closely steered)
Internal auditor	Checks independently that the ISMS works before the external auditor does	External, or an independent internal person
Support functions	HR (joiners, leavers, awareness), procurement (suppliers), legal or DPO	Internal

The ISMS manager: the role that decides everything

When a project gets stuck, the symptom is almost always the same: nobody has the time or the mandate to chase the teams. The ISMS manager does not need to be the best engineer in the company. They need to organise, prioritise, get answers out of IT and report progress to leadership.

Depending on your size, the role sits with the CISO, with a GRC analyst or manager, or with a more senior profile hired for the purpose. If you hand it to someone who keeps a full-time operational job, expect it to come second to every emergency.

The internal auditor: keep it away from the project lead

The standard requires the internal audit to be objective and impartial. Whoever built the ISMS cannot audit their own work. In a smaller organisation, bringing in an external auditor for this step is often the simplest and most credible option.

Who comes in at which stage

Needs shift as the project moves. Mapping them early stops you hiring too soon someone who will be bored, or too late the person everything depends on.

Scoping: sponsor, ISMS manager and often an experienced consultant (Lead Implementer) to set scope and timeline.
Risk assessment: ISMS manager, GRC analyst, technical and business owners. Many French organisations use EBIOS Risk Manager, the method published by ANSSI.
Implementing controls: the longest and most technical phase. Technical owners are on the front line; the GRC analyst tracks actions and documents them.
Internal audit and management review: an independent internal auditor, then the sponsor and ISMS manager.
Certification audit: the ISMS manager as the main point of contact, with technical owners on hand to demonstrate their practices.
Maintenance: ISMS manager and GRC analyst, for the long run, with regular reviews and internal audits.

This is why the strongest set-up often pairs a consultant for the start with an internal profile for what follows. The consultant brings a proven method. The internal person keeps the memory of the system and keeps it running once the engagement ends.

Hire, bring in a consultant, or combine

Option	Strengths	Limits
Consultant only	Fast start, proven method, outside view	The knowledge leaves with them, keeping the certificate still needs an owner
Internal hire only	Knows the company, continuity, cost under control over time	Learning curve if the person has never led a certification
Combination	Method at the start, continuity afterwards, skills transfer	Requires clear split of roles between the two

If you hire, a candidate who has already been through a certification, even in a supporting role, will save you a great deal of time. They know what evidence an auditor expects and where the usual gaps hide. Our guide to hiring a GRC analyst covers the backgrounds that work and a suitable interview case study.

Skills to check in interviews

An ISO 27001 Lead Implementer or Lead Auditor certificate proves a candidate knows the standard. It does not prove they can make an organisation apply it. As our article on cybersecurity certifications explains, what counts is having run the process end to end.

Ask questions that force concrete answers:

"Tell me about a certification you took part in. What exactly was your role?" Listen for scope, trade-offs and difficulties, not just the outcome.
"How did you decide which controls to exclude from the statement of applicability?" A good candidate ties each exclusion to the risk assessment and the scope.
"A team has not delivered the evidence you need three weeks before the audit. What do you do?" You are testing priorities and the ability to get results without line authority.
"What nonconformity has an auditor raised with you, and what did you change afterwards?" You are measuring honesty and a real improvement mindset.
"How would you present the state of the ISMS to an executive committee in five minutes?" You are testing clarity and message.

For technical owners the question is different: check that they can demonstrate a practice (an access review, a backup restore), not just describe it. Our approach to assessing cybersecurity skills fits well here.

Common mistakes

Launching without a mandate from leadership: follow-ups go nowhere and the timeline slips.
Outsourcing everything: the certificate is obtained, then the first surveillance audit shows that nobody runs the system any more.
Writing documents nobody applies: auditors check what happens on the ground, not just the paperwork.
Picking too wide a scope for the first cycle: start with a scope you control, then extend it.
Forgetting support functions: joiners and leavers, supplier contracts and awareness are all examined.
Hiring an executor for a builder's job: a junior analyst can run an existing ISMS well, but rarely build one alone.

In short

A successful ISO 27001 certification depends less on one expert than on clearly assigned roles: a sponsor who decides, an ISMS manager who drives, technical owners who apply, an independent internal auditor and continuity after the audit. Find the missing roles, decide which must stay in-house, and hire first the person who will keep the system alive. If certification is part of a wider regulatory push, our article on the profiles to hire for NIS2 completes the picture.

Preparing for ISO 27001 and missing the person to carry it? At Cyber Recrut, a recruiter and a security practitioner scope the need with you, and our shortlisted candidates prove their skills on hands-on labs. See how we work or tell us about your hiring need.