Senior Compliance Analyst – FedRAMP

This is a fully remote position, open to applicants in United States.

📋 Description

• Act as the Information System Security Officer for the GovCloud system.

• Serve as the primary compliance liaison for CoLab’s agency sponsor, the FedRAMP PMO, and CoLab’s 3PAO.

• Create and manage the Certification Package Overview along with the Security Decision Record and its attachments in Paramify.

• Ensure NIST SP 800-53 control mappings are aligned with the FedRAMP Class D baseline.

• Execute vulnerability reporting in accordance with FedRAMP VDR and VER regulations.

• Oversee the Significant Change Notification process, which includes change classification, Security Impact Analysis, CCB intake, SCN filing, and history maintenance.

• Spearhead the transition to VDR/VER adoption, enforce mandatory SCN regulations, and implement FedRAMP 20x.

• Facilitate monthly Ongoing Certification meetings and coordinate the annual assessment.

• Organize and schedule 3PAO walkthroughs.

• Engage in FedRAMP assessments and audits, encompassing documentation, inquiries, and evidence gathering.

• Take ownership of the Integrated Inventory and reconcile it with Nessus scan coverage.

• Evaluate GovCloud feature eligibility requests in collaboration with Product and Engineering teams.

• Manage responses to security inquiries and questionnaires from customers and agencies.

• Supervise compliance activities and deadlines across FedRAMP and other regulatory frameworks.

• Develop and maintain compliance documentation.

• Collaborate with Security, Compliance, IT, and Cloud teams on evidence collection, boundary updates, and inventory updates.

⛳️ Requirements

• Over 6 years of practical experience in developing, implementing, and maintaining compliance programs, with at least 3 years of direct FedRAMP experience (Moderate/High, now Class B/D).

• Previous experience as an Information Systems Security Officer (or in a similar capacity) for a FedRAMP or FISMA system is highly desirable.

• Proficient knowledge of NIST SP 800-53, FedRAMP Certification Package documentation, and the 3PAO assessment process.

• Familiarity with the FedRAMP Consolidated Rules for 2026 (VDR, VER, SCN) and FedRAMP 20x is a significant advantage.

• Understanding of NIST SP 800-171 and CMMC is beneficial.

• Experience with SOC 2 and ISO 27001 frameworks is a plus.

• Knowledge of U.S. export controls (ITAR and EAR) is essential.

• Proficient in GRC platforms such as Paramify or Vanta, along with vulnerability scanning tools like Nessus.

• Capable of planning and executing work within tight deadlines.

• Competent in reviewing and interpreting technical documentation, regulatory materials, and compliance frameworks.

• Excellent communication and interpersonal skills, with the ability to work collaboratively with cross-functional teams.

• Must be a U.S. person (ITAR, 22 CFR 120.62) and reside within the United States.

• Enhanced background check is mandatory.

🏝️ Benefits

• Stock options package.

• Comprehensive health and benefits coverage.

• Unlimited paid vacation.

• 401K matching.

• Flexibility to work remotely from anywhere in the United States.

• Occasional travel to the Canadian headquarters.