Senior Compliance Analyst - FedRAMP

Role overview Own the compliance lifecycle for a U.S. government cloud system operating under FedRAMP, serving as its Information System Security Officer. The role combines hands-on documentation and evidence management with audit coordination, vulnerability reporting, change review, and preparation for evolving federal requirements. It is remote within the United States, requires U.S. person status, and includes occasional travel to a Canadian headquarters.

Responsibilities - Maintain the FedRAMP certification package, security decision documentation, control mappings, and supporting evidence in a governance platform. - Coordinate with the agency sponsor, FedRAMP program office, and third-party assessor; lead recurring certification meetings and support annual assessments. - Manage vulnerability reporting, remediation timelines, accepted findings, and required agency updates. - Run the significant change process, including change classification, security impact review, board intake, notifications, and records. - Lead readiness for updated FedRAMP rules and guidance, and maintain the system inventory against vulnerability scan coverage and boundary changes. - Review feature eligibility and respond to customer and agency security requests with Product, Engineering, Security, Compliance, IT, and Cloud teams.

Requirements - At least six years developing, implementing, and maintaining compliance programs, including three or more years of direct FedRAMP experience at Moderate or High levels (now Class B or D). - Working knowledge of NIST SP 800-53, FedRAMP certification documentation, and third-party assessment processes. - Knowledge of U.S. export controls, including ITAR and EAR, and ability to interpret technical and regulatory material. - Strong organization and deadline management, with clear communication and cross-functional collaboration skills. - U.S. person status under ITAR and residence in the United States; an enhanced background check is required.

Nice to have - Prior service as an ISSO or similar role for a FedRAMP or FISMA system. - Familiarity with FedRAMP’s updated vulnerability and significant-change rules, FedRAMP 20x, NIST SP 800-171, CMMC, SOC 2, or ISO 27001. - Experience with GRC platforms such as Paramify or Vanta and vulnerability scanning tools such as Nessus.

Benefits and work setup - Full-time permanent role with stock options, extended health benefits, unlimited paid vacation, and 401(k) matching. - Remote work from anywhere in the United States, with occasional travel to Canada.