Lead FedRAMP Compliance Analyst (Moderate)

Elastic; Mountain View (CA); Hybrid; USD 160,000 - 253,000; Full time

Benefits offered by this job

Competitive pay

Health coverage

Flexible schedule

Vacation days

Donation matching

Volunteer hours

Parental leave

Job summary

Elastic is seeking a Principal Security Compliance Analyst to lead FedRAMP Moderate activities, maintain critical documentation, and coordinate with federal partners and internal teams. This is a high-impact security role within a distributed company.

You will manage authorization and continuous monitoring, ensure evidence and controls are up to date, and drive remediation across Security, Engineering, IT, Product, and Legal teams. DoD IL4+ eligibility is preferred.

Qualifications

• 5+ years of experience managing or supporting a FedRAMP Moderate program.
• Strong understanding of FedRAMP, NIST SP 800-53, and continuous monitoring requirements.
• Experience with SSPs, POA&Ms, control evidence, vulnerability management, and security assessments.

Responsibilities

• Manage the FedRAMP Moderate authorization and continuous monitoring program.
• Maintain the System Security Plan, policies, procedures, evidence, inventories, diagrams, and other required documentation.
• Coordinate assessments and reviews with our 3PAO, federal agency partners, consultants, and internal teams.
• Track security findings and POA&M items through remediation.
• Work with Security, Engineering, IT, Product, and Legal teams to implement and maintain required controls.
• Monitor program deadlines, risks, and compliance metrics and report progress to leadership.
• Review system and product changes for potential FedRAMP impact.
• Help control owners understand their responsibilities and prepare appropriate evidence.

Skills

FedRAMP Moderate

NIST SP 800-53

POA&M management

Project management

Communication with auditors

DoD IL-4+ clearance eligibility

Job description

Elastic is seeking a Principal Security Compliance Analyst to lead FedRAMP Moderate activities, maintain critical documentation, and coordinate with federal partners and internal teams. This is a high-impact security role within a distributed company.

You will manage authorization and continuous monitoring, ensure evidence and controls are up to date, and drive remediation across Security, Engineering, IT, Product, and Legal teams. DoD IL4+ eligibility is preferred.