FedRAMP Compliance Lead — GRC & Audit Expert

Asana; San Francisco (CA); On-site; USD 150,000 - 210,000; Full time

Job summary

Asana is seeking a Security Risk and Compliance Lead to mature and operate FedRAMP ConMon and drive certification programs. You will partner with Security Engineering, Legal, Privacy, and R&D to ensure controls are effective and certifications maintained.

The role sits in San Francisco with a hybrid, office-centric schedule; in-office days are Mon, Tue, and Thu, with optional WFH on Wednesdays. Fridays depend on work and teams involved.

Qualifications

• 5+ years of experience in Governance, Risk, and Compliance (GRC) or related field.
• Hands-on FedRAMP experience, including Continuous Monitoring (ConMon) and evidence collection.
• Foundational knowledge of SOC 2, ISO 27001, or NIST CSF is a plus, with depth in FedRAMP prioritized.

Responsibilities

• Own FedRAMP Continuous Monitoring tasks and monthly ConMon submissions.
• Coordinate with Engineering, Legal, Privacy, and IT to meet FedRAMP obligations.
• Support SOC 2, ISO 27001, and other certifications and audit cycles.
• Automate or streamline evidence collection and maintain auditable artefacts.

Skills

GRC expertise

FedRAMP ConMon

Evidence collection

Audit coordination

Cross-functional communication

Job description

Asana is seeking a Security Risk and Compliance Lead to mature and operate FedRAMP ConMon and drive certification programs. You will partner with Security Engineering, Legal, Privacy, and R&D to ensure controls are effective and certifications maintained.

The role sits in San Francisco with a hybrid, office-centric schedule; in-office days are Mon, Tue, and Thu, with optional WFH on Wednesdays. Fridays depend on work and teams involved.