FedRamp Compliance Analyst

Abnormalsecurity; United States; On-site; USD 115,000 - 173,000; Full time

Job summary

Abnormal AI is seeking a Federal Security and Compliance Analyst to scale our FedRAMP High/Class D program and own security requirement implementation. You will drive evidence collection, remediation, and readiness across Security, Engineering, IT, and Ops teams.

The role emphasizes building compliance-as-code capabilities, structured control content, and automated evidence indexing, with a focus on reducing ambiguity and improving operational usefulness.

Qualifications

• 2+ years of experience in security, compliance, GRC, risk, audit, security operations, or related discipline.
• Experience with NIST SP 800-53 and translating controls into technical implementation, processes, and audit evidence.
• Experience with core compliance operations such as evidence collection, control documentation, vulnerability remediation, risk tracking, audit support, or continuous monitoring.
• Ability to read architecture diagrams, security docs, vulnerability findings, Jira tickets, logs, or eng materials and turn them into clear compliance actions.
• Ability to collaborate with Security, Engineering, IT/Operations, and other technical teams.
• Strong written communication and ability to create precise yet understandable documentation for assessors and teams.
• Operational discipline to manage multiple workstreams, dependencies, owners, and deadlines; escalate risk early.
• Drive automation and better processes to streamline work and create reusable templates.

Responsibilities

• Own federal security and compliance workstreams from interpretation to implementation, evidence collection, remediation, and readiness.
• Drive recurring continuous monitoring and evidence workflows across teams to ensure evidence is current, complete, and traceable.
• Support vulnerability detection and response, including reconciling findings, risk triage, Jira routing, and audit-ready evidence.
• Partner with technical teams on security and compliance impact; support security assessments and change management before production changes.
• Help build Abnormal's compliance-as-code program with machine-readable artifacts and reusable workflows.
• Maintain accurate control, evidence, remediation, risk, and ownership records; identify gaps and aging items.
• Contribute to federal authorization artifacts and customer assurance through artifacts and responses.

Skills

Security & Compliance

NIST SP 800-53

Cross-functional collaboration

Automation & process improvement

Strong written communication

Risk & remediation tracking

Tools

Jira

Git-based workflows

JSON/YAML schemas

Job description

About the Role

Abnormal AI is looking for a Federal Security and Compliance Analyst who wants to help build how modern federal compliance operates inside a fast-moving cybersecurity company.

You will work at the intersection of security engineering, cloud operations, security, and federal compliance, helping Abnormal Gov scale its FedRAMP High/Class D security and compliance program. You will own security requirement implementation and evidence, work directly with technical teams to drive risk and remediation to closure, and help build our compliance as code capabilities in alignment with FedRAMP 20x.

You'll have meaningful ownership early, with the opportunity to improve processes rather than simply inherit them. The strongest candidate will be technically curious, highly organized, comfortable navigating ambiguity, and motivated by making compliance more accurate, automated, measurable, and operationally useful.

What you will do

• Own assigned federal security and compliance workstreams from requirement interpretation through implementation, evidence collection, remediation, and review readiness.
• Drive recurring continuous monitoring and evidence workflows, coordinating across Security, FedOps, Engineering, IT, People Operations, GRC, and other control performers to ensure evidence is current, complete, traceable, and retained correctly.
• Support vulnerability detection and response, including reconciling findings from tools such as Wiz, Nessus, and Burp; risk-based triage; Jira routing; SLA tracking; remediation follow-through; validation; and audit-ready evidence.
• Partner with technical teams on security and compliance impact, supporting Security Impact Assessments, Significant Change Requests, control implementation decisions, and other change-management activities before changes reach production.
• Help build Abnormal's compliance-as-code program, including structured control content, JSON/YAML or other machine-readable artifacts, schema validation, evidence indexing, automation, deterministic document generation, and reusable workflows.
• Maintain accurate control, evidence, remediation, risk, and ownership records, proactively identifying gaps, aging items, dependencies, and decisions requiring escalation.
• Contribute to federal authorization and assessment artifacts, including control documentation, Security Decision Records, certification-package content, assessor requests, and continuous monitoring deliverables.
• Support federal customer assurance by providing clear, accurate compliance guidance and artifacts for customer onboarding, POVs, DDQs, RFPs, and other government or regulated customer requests.

Must Haves

• 2+ years of experience in security, compliance, GRC, risk, audit, security operations, or a related discipline, preferably in a cloud, SaaS, government, or highly regulated environment.
• Working knowledge of NIST SP 800-53 and an understanding of how security controls translate into technical implementation, operational processes, and audit evidence.
• Experience with one or more core compliance operations such as evidence collection, control documentation, vulnerability remediation, risk tracking, audit support, or continuous monitoring.
• Technical curiosity and the ability to read architecture diagrams, security documentation, vulnerability findings, Jira tickets, logs, or engineering materials and turn them into clear compliance actions.
• Ability to work effectively with Security, Engineering, Infrastructure/Operations, IT, and other technical teams without needing every problem or requirement to be fully defined in advance.
• Strong written communication skills and the ability to produce documentation that is precise enough for assessors and technical teams while remaining understandable to non-technical stakeholders.
• Strong operational discipline: you can manage multiple workstreams, dependencies, owners, and deadlines while identifying problems and escalating risk early.
• A demonstrated tendency to improve the way work gets done through automation, better processes, clearer documentation, reusable templates, better data, or simpler workflows.

.

Nice to Have

• Experience with FedRAMP High, FedRAMP Moderate, FISMA, CMMC, GovRAMP, or other U.S. government security frameworks.
• Exposure to compliance-as-code, OSCAL, JSON/YAML schemas, Git-based workflows, automated validation, Markdown/PDF generation, or machine-readable authorization artifacts.
• Familiarity with tools or environments such as AWS GovCloud, Wiz, Splunk, Okta, Jira, GitLab, Nessus, Burp, or cloud-native vulnerability-management platforms.
• Experience supporting Security Impact Assessments, Significant Change Requests, POA&M/ConMon workflows, 3PAO assessments, or federal authorization packages.
• Basic scripting or automation experience—such as Python, APIs, CI/CD workflows, or data transformation—or a strong interest in developing those skills.

#LI-PP1

Actual compensation will be determined based on several non-discriminatory factors including skills, experience, qualifications, and geographic location.
In addition to base salary, this role may be eligible for bonus or incentive compensation, equity, and a comprehensive benefits package.

Base salary range: $114,800 — $173,250 USD

A note on AI in our process:
Abnormal AI uses AI-assisted tools to help our recruiting team prepare for candidate interviews. These tools analyze resume content and role requirements to suggest interview questions and areas for the interviewer to explore.They do not make hiring decisions or screen candidates automatically. Every decision about a candidacy is made by a person. Further, if your application is successful and Abnormal AI makes a conditional offer of employment, we will carry out pre-employment checks which must be successfully completed to progress to a final offer. All processes and pre-employment checks are in line with prevailing legislation and Abnormal AI's policies relevant to our security and privacy standards.

Abnormal AI is an equal opportunity employer. Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, protected veteran status or other characteristics protected by law. For our EEO policy statement please click here. If you would like more information on your EEO rights under the law, pleaseclick here.