Senior Staff Compliance Specialist

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee FedRAMP readiness evaluations, pinpoint control deficiencies, and collaborate with control owners to establish remediation priorities and timelines.

• Sustain FedRAMP documentation and evidence that demonstrate the implementation and ownership of security controls.

• Organize the scope, timeline, and evidence requests necessary for independent assessments.

• Collaborate with control owners to address any findings.

• Manage ongoing monitoring activities, which include control assessments, vulnerability follow-ups, and reporting.

• Evaluate proposed system modifications and provide guidance to teams on their effects on FedRAMP scope and controls.

• Monitor changes to FedRAMP requirements and communicate necessary actions to impacted teams.

• Oversee milestones and interdependencies across various teams.

• Provide progress updates and highlight risks and decisions that need leadership involvement.

• Utilize GRC tools and automation to enhance the collection and reuse of evidence.

• Manage all FedRAMP and CMMC compliance initiatives, including scope, schedules, evidence, and readiness for assessments.

• Collaborate with engineering, security, and IT teams to prepare for assessments, address control deficiencies, and maintain compliance progress.

⛳️ Requirements

• Senior: 5+ years of experience in GRC, compliance, or auditing.

• Staff: 8+ years of experience in GRC, compliance, or auditing.

• Senior: 3+ years of hands-on experience with FedRAMP, including readiness or assessments for FedRAMP High.

• Staff: 5+ years of hands-on FedRAMP experience, including at least one FedRAMP High authorization or assessment, and support for independent assessments or continuous monitoring for a cloud service.

• Practical experience in documenting and assessing security controls, including NIST SP 800-53, and preparing evidence for external evaluations.

• Proficient understanding of cloud infrastructure, including networking, access control, and logging, enabling assessment of control implementation and technical discussions with engineering teams.

• Experience with CMMC or NIST SP 800-171 requirements, in addition to FedRAMP.

• Proven ability to coordinate compliance efforts with technical teams and drive remediation to completion.

• Capability to clearly articulate security requirements to both technical and business teams, and influence outcomes without direct authority.

• Preferred: hands-on experience with AWS, Azure, or GCP security configurations or services.

• Preferred: familiarity with ISO/IEC 27001 or SOC 2, particularly in relation to mapping controls across frameworks.

• Preferred: experience in automating control evidence with GRC tools, CI/CD pipelines, or infrastructure as code.

• Preferred: experience leading cross-functional workstreams and presenting to senior leadership.

• Preferred: relevant professional certifications, such as CISA, CISSP, CRISC, or Certified CMMC Professional.

🏝️ Benefits

• Equal employment opportunity for all applicants and employees.

• Diversity and multicultural workforce.