Lead Product GRC Subject Matter Expert

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee the development, improvement, and management of federal compliance controls, evidence requirements, and implementation guidance throughout their lifecycle.

• Create control rationales, acceptance criteria, and customer-facing documentation as standard product content.

• Interpret assessment procedures from NIST 800-53A, baselines from 800-53B, organization-defined parameters, and FedRAMP constraints.

• Break down controls into technical responsibilities and address inherited, shared, and customer-owned obligations.

• Establish evidence expectations based on PPSM, STIG, and CIS hardening standards, along with scan outputs.

• Convert controls and infrastructure contexts into automated testing and continuous monitoring detectors.

• Define test logic, data sources, edge cases, and conditions for failure.

• Collaborate with Engineering to implement and sustain detectors with versioned framework mappings.

• Develop machine-readable federal content for OSCAL and FedRAMP 20x.

• Maintain bidirectional mappings across federal compliance frameworks.

• Work with Product Management and Design on discovery, UI/UX, PRDs, and acceptance criteria.

• Collaborate with Engineering and ML on AI-assisted compliance guidance, evaluation sets, and safety guardrails.

• Evaluate feedback from customers, agencies, 3PAOs, and internal sources to identify content gaps and deliver updates.

• Mentor and guide other SMEs, establish content quality standards, and define framework strategy.

⛳️ Requirements

• 8–10+ years of experience in Governance, Risk, and Compliance (GRC) and/or Information Security.

• Practical federal compliance experience, including the establishment or maintenance of FedRAMP programs on the CSP side.

• Experience in authoring System Security Plans (SSPs) and supporting artifacts, as well as conducting continuous monitoring.

• Proficient understanding of the relationship between NIST 800-53 and FedRAMP, including 800-53A/B, organization-defined parameters, control inheritance, non-applicability, customer responsibility matrices, PPSM, and STIG/CIS benchmarks.

• Familiarity with OSCAL or other machine-readable compliance methods.

• Capability to translate controls into functional tests with clearly defined pass/fail criteria, evidence sufficiency standards, and system-component coverage.

• Skill in converting requirements into productizable capabilities.

• Current experience with AI in GRC tasks, including AI pair-programming tools, lightweight automations, APIs, webhooks, LLM-assisted workflows, measured outcomes, and safe-use patterns.

• Attention to detail with control wording, mapping accuracy, and evidence specificity.

• Proficient with spreadsheets and handling large datasets.

• Exceptional written and verbal communication abilities.

• Ability to collaborate effectively with engineers, designers, GTM teams, agencies, 3PAOs, and customers.

• Capability to work independently at a Lead level.

• Willingness to utilize AI responsibly to enhance efficiency and impact.

• Experience with DoD impact levels IL4/IL5 or CMMC is highly desirable.

• Familiarity with StateRAMP, CNSSI 1253/ICD 503, GovCloud or IL-environment architecture, or prior experience with GRC platform products/content are advantageous.

• Preferred certifications include CISSP-ISSEP, CISA, FedRAMP 3PAO assessor credentials (CCP/CCA), or CISM, though not required.

🏝️ Benefits

• Competitive salary within the industry.

• Equity options available.

• Comprehensive coverage for medical, dental, and vision care.

• 100% coverage of employee-only benefit premiums for most medical plans.

• 16 weeks of paid Parental Leave for all new parents.

• Health & wellness stipend provided.

• Stipends for remote workspace, internet, and cellphone expenses.

• Commuter benefits for team members commuting to the SF and NYC offices.

• Family planning benefits included.

• 401(k) matching contributions with immediate vesting.

• Flexible Paid Time Off (PTO) policy.

• 80 hours of Sick Time available.

• 11 paid holidays provided by the company.

• Opportunities for virtual team-building activities, lunch and learns, and other company-wide events.