Staff Compliance Analyst - Federal

Position Overview

As a Staff Federal Security Compliance Analyst on the Federal Security and Compliance team, you will serve as a lead of our compliance strategy. Your mission is to safeguard and strengthen our position as a leading Identity-as-a-Service (IDaaS) provider for the public sector.

In this staff-level role, you are not just a practitioner but a strategic leader who bridges the gap between engineering, product, and federal regulatory bodies. You will drive the maintenance of our FedRAMP and DoD (IL4/IL5) authorizations, lead complex audits, and mentor junior analysts to ensure a security-first culture.

Job Duties and Responsibilities

The responsibilities listed below represent the core functions of this role. While a Staff Analyst is expected to have the capability to lead across all areas, the daily focus will typically involve a dynamic combination of these duties based on current mission priorities and team needs:

• Strategic Audit Leadership: Lead end-to-end FedRAMP and DoD audits, serving as the primary point of contact for external 3PAOs and government agencies.


• Continuous Monitoring Strategy: Oversee and evolve the continuous monitoring (ConMon) program. Design sophisticated reporting mechanisms for vulnerability management and risk posture for executive leadership.


• Engineering Advisory: Act as a senior consultant to Engineering and Product teams, translating complex NIST 800-53 requirements into actionable technical specifications for cloud-native environments.


• Impact Assessment & Risk Management: Lead the assessment of high-impact changes to federal systems. Ensure that system evolutions maintain a rigorous security posture without sacrificing innovation.


• Cross-Functional Alignment: Drive synchronization between GRC, Security, Marketing, Sales, Engineering, and Product to ensure federal requirements are integrated into the broader corporate roadmap.


• Programmatic Gap Analysis: Proactively identify and lead initiatives to close gaps between current capabilities and future regulatory requirements (e.g., emerging NIST standards, new DoD mandates, or IL6 requirements).


• Evidence Automation & FedRAMP 20x Readiness: Drive the build-out and support of automated evidence collection and control validation. Lead the transition toward "FedRAMP 2.0" standards (including OSCAL integration), defining and monitoring Key Security Indicators (KSIs) to provide real-time compliance visibility.

Minimum Required Knowledge, Skills, and Abilities

• Education: Bachelor’s degree in Computer Science, MIS, Cybersecurity, or a related technical field.


• Experience: 7+ years of experience in security compliance, with at least 4-5 years specifically focused on the FedRAMP/NIST 800-53 framework.


• Automation & Compliance Engineering: Demonstrated experience with automation tools or scripting (e.g., Python, Go, or SQL) for automated evidence collection. Familiarity with API-based control validation and OSCAL-based tooling (e.g., Trestle, LULA, or similar GRC automation frameworks).


• Technical Depth: Deep understanding of cloud-native infrastructure (IaaS, PaaS, SaaS) and how infrastructure components (networking, OS, databases) support a distributed cloud application.


• Framework Mastery: Expert-level knowledge of NIST SP 800-53, FedRAMP High/Moderate, and DoD SRG (IL4, IL5, and familiarity with IL6).


• Operational Knowledge: Proven experience with access management, CI/CD pipelines, disaster recovery, and encryption/key management in a cloud context.


• Analytical Leadership: Ability to analyze complex "edge-case" security scenarios and provide remediation paths that align with both business goals and regulatory requirements.


• Communication: Exceptional presentation skills with the ability to explain technical compliance risks to non-technical executive stakeholders.

Preferred Certifications & Skills

• Advanced Certifications: CISSP (highly preferred), CISA, or CCSK.


• Cloud Expertise: AWS Certified Solutions Architect or Cloud Practitioner.


• Tooling: Expert-level proficiency with JIRA, ServiceNow, and Okta.


• Technical Background: Prior experience in a DevOps, Security Engineering, or Systems Administration role is a significant plus.

Additional requirements:

• This position requires the ability to access federal environments and/or have access to protected federal data. As a condition of employment for this position, the successful candidate must be able to submit documentation establishing U.S. Person status (e.g. a U.S. Citizen, National, Lawful Permanent Resident, Refugee, or Asylee. 22 CFR 120.15) upon hire.

P24525_3348081