Senior Security Analyst (Governance and Trust)

Role overview Stand up the public-sector security program that earns and keeps government trust by turning federal requirements into living, operating controls instead of paperwork. This position focuses on supporting CMMC compliance and building the continuous monitoring and continuous authorization capability that will anchor broader public-sector posture across regimes such as FedRAMP 20x, Facility Clearance, IRAP, and Germany's C5. It suits someone with hands-on federal or defense experience who treats NIST, RMF, and POA&Ms as a starting point for real risk reduction.

Responsibilities - Design and operate a portable continuous monitoring and continuous authorization capability that transfers cleanly across multiple public-sector frameworks. - Translate CMMC 2.0, FedRAMP 20x, and related requirements into practical controls, evidence pipelines, and risk-prioritized recommendations. - Partner with engineering and product security teams to map federal requirements onto cloud-native systems and software supply chain infrastructure. - Support pursuit of a Facility Clearance, including the governance and process implications that come with it. - Build scalable systems for control ownership, evidence collection, remediation tracking, exceptions, and reporting, favoring automation and policy-as-code. - Coordinate across security, federal strategy, go-to-market, product, engineering, and legal to keep program work moving and escalate interpretive questions appropriately.

Requirements - Real technical depth with cloud-native architecture, SaaS product design, and software development practices, able to engage directly with engineers rather than only describe controls at a policy level. - Meaningful firsthand experience operating inside a federal, defense, or intelligence environment in a technical or operational capacity such as engineering, SOC, or ISSM/ISSO with decision authority. - Working knowledge of CMMC Level 2 and at least one of FedRAMP, RMF, or NIST 800-53, applied practically rather than academically. - Sharp risk-based judgment and willingness to flag when a technically compliant answer does not actually reduce risk.

Nice to have - Exposure to federal personnel or Facility Clearance processes. - Familiarity with FedRAMP 20x or other automated, continuous approaches to federal compliance. - Experience with policy-as-code, GitOps, continuous control monitoring, or automated evidence collection. - Familiarity with non-US public-sector security regimes such as IRAP or Germany's C5. - Background in software supply chain security concepts including SBOMs, artifact signing, provenance, SLSA, or secure CI/CD. - Experience at a high-growth startup or security-first technology company.

Benefits and work setup Remote-first culture with team meetups and bi-annual destination summits, plus a monthly stipend for coworking space, phone, and internet. Full premium coverage for health, vision, and dental insurance for the employee and dependents. Stock options granted at hire and promotion with secondary offering participation and a 10-year exercise window. Flexible time off, and 18 weeks paid parental leave for birthing parents and 12 weeks for non-birthing parents. Posted base salary range: $110,000 to $130,000 USD.