Senior Technical Compliance Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee comprehensive external audits and certifications, which encompass scoping, audit planning, evidence gathering, auditor interaction, findings assessment, and final results.

• Manage internal audit schedules and track remediation efforts.

• Create accountability for audit findings, project milestones, dependencies, and resolution timelines.

• Act as the primary point of contact for auditors and enterprise clients during security evaluations and detailed audit sessions.

• Align regulatory requirements with the central control framework and perform gap analysis.

• Evaluate the maturity of compliance programs and report on risks, gaps, trends, and delivery progress.

• Generate and review security documentation and audit evidence intended for customers.

• Steer cross-functional initiatives that promote the ARC roadmap.

• Develop and sustain executive and operational dashboards along with Jira workflows.

• Guide stakeholders and partner teams on best practices in compliance.

• Conduct federal assessments in collaboration with 3PAOs, agency sponsors, and the FedRAMP PMO.

• Oversee the federal continuous monitoring program, which includes vulnerability assessments and maintenance of the Plan of Action and Milestones (POA&M).

• Direct annual technical evaluations and updates for FedRAMP artifacts, including Security Self-Assessment Report (SSP), Incident Security Control Plan (ISCP), and Incident Response Plan (IRP).

• Provide guidance to Engineering and Operations on cloud configurations that adhere to FIPS 140-2, boundary protection, access control, and DoD IL5+ requirements.

• Represent MongoDB in technical evaluations with 3PAOs and federal entities.

• Interpret regulatory requirements and technical controls for both technical and non-technical audiences.

⛳️ Requirements

• US Citizenship is mandatory.

• Bachelor's degree in a technical discipline such as Information Systems, Computer Science, or Cybersecurity, or equivalent practical experience.

• Over 7 years of experience in Governance, Risk, and Compliance (GRC), Information Security, or IT Audit, ideally within a SaaS or cloud setting, with a strong emphasis on US Public Sector frameworks (FedRAMP, DoD SRG, CJIS).

• Proven track record in leading technical audits or compliance programs.

• In-depth knowledge of cloud security principles and risk management across AWS, Google Cloud, or Azure.

• Extensive understanding of NIST 800-53 and NIST 800-171 controls and their implementation within cloud infrastructures.

• Demonstrated experience managing federal audits from initiation to the issuance of an Authorization to Operate (ATO).

• Capability to articulate complex security configurations to government auditors and internal technical teams.

• Advanced skills in Jira and Confluence.

• Hands-on experience with control mapping, gap analyses, remediation management, and program or control maturity evaluations.

• High proficiency with Jira or similar platforms for managing audit findings, control data, and remediation processes.

• Exceptional written and verbal communication abilities.

• Preferred certifications include CISA, CRISC, CISSP, or ISO Lead Implementer.

🏝️ Benefits

• Equity.

• Employee stock purchase program.

• Flexible paid time off.

• 20 weeks of fully-paid gender-neutral parental leave.

• Fertility and adoption assistance.

• 401(k) plan.

• Mental health counseling.

• Transgender-inclusive health insurance coverage.

• Health benefits offerings.

• Employee affinity groups.

• Supportive and enriching culture.

• Necessary accommodations for disabilities during the application and interview process.