FedRAMP & GRC Security Lead

Asana; San Francisco, Northern (CA, KY); Hybrid; USD 158,000 - 180,000; Full time

Benefits offered by this job

Mental health, wellness & fitness

Career coaching & support

Inclusive family building benefits

Long-term savings or retirement plans

In-office culinary options

Job summary

Asana is seeking a Security Risk and Compliance Lead to mature and operate FedRAMP, SOC 2, and ISO 27001 programs. The role sits at the intersection of GRC and compliance engineering, owning FedRAMP day-to-day while supporting audit cycles and control frameworks across standards.

The position is based in San Francisco with a hybrid schedule (office Mon/Tue/Thu; optional WFH Wed; Fri depending on work). You will partner with Security, Legal, Privacy, and R&D to ensure obligations are met and

Qualifications

• 5+ years in Governance, Risk, and Compliance (GRC).
• Hands-on FedRAMP experience (ConMon, evidence collection, or Moderate/High boundary).
• Knowledge of SOC 2, ISO 27001, or NIST CSF helpful, but FedRAMP depth matters most.
• Organised and deadline-driven with multiple workstreams.
• Able to explain compliance to technical and non-technical stakeholders.
• Experience with compliance automation or evidence collection tooling is a plus.
• Curiosity about modern SaaS engineering and AI tools.

Responsibilities

• Own FedRAMP Continuous Monitoring package submissions and timeliness.
• Drive completion of FedRAMP requirements with cross-functional teams.
• Maintain calendars of FedRAMP deliverables and flag risks.
• Act as internal SME for FedRAMP and guidance for teams.
• Support evidence collection workflows and remediation activities.
• Assist in broader controls maturity efforts across SOC 2, ISO 27001.

Skills

GRC

FedRAMP

Certification

Audits

Cross-team collaboration

Communication

Automation mindset

SaaS security

Tools

GRC platforms

Scripting

APIs

Job description

Asana is seeking a Security Risk and Compliance Lead to mature and operate FedRAMP, SOC 2, and ISO 27001 programs. The role sits at the intersection of GRC and compliance engineering, owning FedRAMP day-to-day while supporting audit cycles and control frameworks across standards.

The position is based in San Francisco with a hybrid schedule (office Mon/Tue/Thu; optional WFH Wed; Fri depending on work). You will partner with Security, Legal, Privacy, and R&D to ensure obligations are met and