FedRAMP Compliance Lead: Drive GRC & Certifications

Decisive Point; San Francisco (CA); Hybrid; USD 158,000 - 180,000; Full time

Benefits offered by this job

Mental health benefits

Career coaching & support

Inclusive family building benefits

Long-term savings/retirement plans

In-office culinary options

Job summary

Asana is seeking a Security Risk and Compliance Lead to mature and operate FedRAMP Continuous Monitoring and authorization activities in a SaaS environment. The role sits at the intersection of GRC work and compliance engineering, partnering with Security Engineering, Legal, Privacy, and R&D.

The position is based in San Francisco with a hybrid schedule: in‑office Mon/Tue/Thu, optional Wed remote, and Friday depending on work and teams. Strong FedRAMP grounding is essential.

Qualifications

• 5+ years of experience in Governance, Risk, and Compliance (GRC) or related field.
• Hands-on experience with FedRAMP—ConMon, evidence collection, or working within FedRAMP Moderate/High boundary.
• Foundational knowledge of SOC 2, ISO 27001, or NIST CSF.

Responsibilities

• Own the monthly FedRAMP ConMon package submission.
• Track and drive completion of all timebound FedRAMP requirements with Engineering, People, and other teams.
• Maintain a calendar of FedRAMP deliverables and flag risks to timelines.
• Serve as the internal FedRAMP subject matter expert for queries from internal teams.
• Engage with Engineering, IT, and People to remediate control gaps.

Skills

FedRAMP

ConMon

Evidence collection

GRC

SOC 2

ISO 27001

NIST CSF

Audit coordination

Cross-functional

Communication

Job description

Asana is seeking a Security Risk and Compliance Lead to mature and operate FedRAMP Continuous Monitoring and authorization activities in a SaaS environment. The role sits at the intersection of GRC work and compliance engineering, partnering with Security Engineering, Legal, Privacy, and R&D.

The position is based in San Francisco with a hybrid schedule: in‑office Mon/Tue/Thu, optional Wed remote, and Friday depending on work and teams. Strong FedRAMP grounding is essential.