Want to know if this job is worth applying to?
United States
Remote only
This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Technical Compliance Analyst based in the United States .
Take ownership of critical public-sector security and compliance programs in a senior individual-contributor role focused on securing and maintaining authorizations for highly regulated government environments. You will lead complex federal assessments and oversee compliance workstreams involving FedRAMP High, DoD IL5+, CJIS, and ITAR. Acting as a key connection between external auditors, government stakeholders, and internal Engineering, Operations, and Legal teams, you will translate regulatory requirements into practical technical controls. You will also shape continuous monitoring strategies, manage remediation priorities, and ensure that cloud environments remain audit-ready. This role offers significant technical influence and the opportunity to help enable secure cloud services for US federal, state, and local government customers.
Lead end-to-end external audits and certifications, including scoping, audit planning, evidence collection, auditor coordination, findings management, and final outcomes.
Direct federal assessment workstreams, coordinating with Third Party Assessment Organizations (3PAOs), agency sponsors, and the FedRAMP Program Management Office.
Manage the federal continuous monitoring program, including vulnerability analysis and reporting, remediation tracking, and maintenance of the Plan of Action and Milestones (POA&M).
Lead annual updates and technical reviews of key FedRAMP documentation, including the System Security Plan (SSP), Contingency Plan (ISCP), and Incident Response Plan (IRP).
Serve as a primary point of contact for external auditors and enterprise customers during technical security reviews and audit discussions.
Translate NIST and other regulatory requirements into actionable technical controls for Engineering and Operations teams.
Advise on cloud security configurations, including FIPS 140-2, boundary protection, and access controls, to meet federal and DoD IL5+ requirements.
Map regulatory requirements to the central control framework and conduct gap analyses for new frameworks, jurisdictions, and market expansions.
Own internal audit schedules and remediation workflows, establishing accountability, milestones, dependencies, and resolution timelines.
Assess compliance maturity and communicate material risks, gaps, trends, and program progress to business and technical leadership.
Prepare and review customer-facing security documentation and audit evidence to ensure accuracy and alignment with technical architecture.
Build and maintain executive dashboards and Jira workflows for control performance, audit findings, and remediation progress.
Lead cross-functional compliance initiatives, identify delivery risks and dependencies, recommend process improvements, and mentor stakeholders on effective compliance practices.
Bachelor's degree in a technical field such as Information Systems, Computer Science, or Cybersecurity, or equivalent practical experience.
At least 7 years of experience in Governance, Risk, and Compliance (GRC), Information Security, or IT Audit, preferably in SaaS or cloud environments.
Significant experience with US public-sector compliance frameworks, particularly FedRAMP, DoD Security Requirements Guide (SRG), and CJIS.
Demonstrated experience leading technical audits or complex compliance programs, ideally managing federal assessments from kickoff through Authorization to Operate (ATO).
Deep understanding of NIST SP 800-53 and NIST SP 800-171 controls and their implementation in cloud-native environments.
Strong knowledge of cloud security architecture, risk management, and security controls across AWS, Google Cloud, or Microsoft Azure.
Practical experience with control mapping, gap analysis, remediation oversight, and compliance maturity assessments.
Advanced proficiency with Jira and Confluence, or comparable tools, for managing audit findings, control performance data, documentation, and large-scale remediation workflows.
Excellent written and verbal communication skills, including the ability to explain complex security configurations to auditors, government stakeholders, and technical teams.
Ability to work independently in ambiguous and complex situations, exercise sound judgment, and take accountability for program outcomes.
Strong stakeholder management and influencing skills, with the ability to communicate regulatory requirements clearly to both technical and non-technical audiences.
Preferred certifications include CISA, CRISC, CISSP, or ISO Lead Implementer.
Base salary: $95,000–$187,000 USD, depending on skills, experience, qualifications, and work location.
Potential equity compensation and participation in an employee stock purchase program.
Flexible paid time off.
20 weeks of fully paid, gender-neutral parental leave.
Fertility and adoption assistance.
401(k) retirement plan.
Mental health counseling and support.
Health insurance options, including transgender-inclusive coverage.
Additional employee wellbeing and support programs.