Senior Compliance Analyst - FedRAMP

colabsoftware; United States; Remote; USD 130,000 - 180,000; Full time

Benefits offered by this job

Stock options

Extended health benefits

Unlimited paid vacation

401(k) matching

Remote work within US

Occasional travel to Canada

Job summary

ColabSoftware seeks an Information System Security Officer to own the compliance lifecycle for a U.S. government cloud system operating under FedRAMP.

The role combines hands-on documentation, evidence management, audit coordination, vulnerability reporting, and change review in a remote-capable US setting. Responsibilities include maintaining certification packages, coordinating with sponsors and assessors, and leading readiness for evolving federal requirements while collaborating across

Qualifications

• Six+ years developing and maintaining compliance programs.
• Three+ years FedRAMP Moderate/High (Class B or D) experience.
• Knowledge of ITAR/EAR regulations and ability to interpret regulatory material.
• Strong organization and cross-functional communication skills.

Responsibilities

• Maintain the FedRAMP certification package and documentation with governance platform.
• Coordinate with sponsor, FedRAMP program office, and third-party assessor; lead certification meetings and annual assessments.
• Manage vulnerability reporting, remediation timelines, accepted findings, and agency updates.
• Run the significant change process with classification, security impact review, and records.
• Lead readiness for updated FedRAMP rules and maintain system inventory against vulnerability scans.
• Review feature eligibility and respond to security requests with Product, Engineering, Security, Compliance, IT, and Cloud teams.

Skills

FedRAMP experience

NIST SP 800-53 knowledge

Compliance program management

ITAR/EAR knowledge

Vulnerability management

Cross-functional collaboration

Tools

Paramify

Vanta

Nessus

Job description

Role overview

Own the compliance lifecycle for a U.S. government cloud system operating under FedRAMP, serving as its Information System Security Officer. The role combines hands-on documentation and evidence management with audit coordination, vulnerability reporting, change review, and preparation for evolving federal requirements. It is remote within the United States, requires U.S. person status, and includes occasional travel to a Canadian headquarters.

Responsibilities

• Maintain the FedRAMP certification package, security decision documentation, control mappings, and supporting evidence in a governance platform.
• Coordinate with the agency sponsor, FedRAMP program office, and third-party assessor; lead recurring certification meetings and support annual assessments.
• Manage vulnerability reporting, remediation timelines, accepted findings, and required agency updates.
• Run the significant change process, including change classification, security impact review, board intake, notifications, and records.
• Lead readiness for updated FedRAMP rules and guidance, and maintain the system inventory against vulnerability scan coverage and boundary changes.
• Review feature eligibility and respond to customer and agency security requests with Product, Engineering, Security, Compliance, IT, and Cloud teams.

Requirements

• At least six years developing, implementing, and maintaining compliance programs, including three or more years of direct FedRAMP experience at Moderate or High levels (now Class B or D).
• Working knowledge of NIST SP 800-53, FedRAMP certification documentation, and third-party assessment processes.
• Knowledge of U.S. export controls, including ITAR and EAR, and ability to interpret technical and regulatory material.
• Strong organization and deadline management, with clear communication and cross-functional collaboration skills.
• U.S. person status under ITAR and residence in the United States; an enhanced background check is required.

Nice to have

• Prior service as an ISSO or similar role for a FedRAMP or FISMA system.
• Familiarity with FedRAMP's updated vulnerability and significant-change rules, FedRAMP 20x, NIST SP 800-171, CMMC, SOC 2, or ISO 27001.
• Experience with GRC platforms such as Paramify or Vanta and vulnerability scanning tools such as Nessus.

Benefits and work setup

• Full-time permanent role with stock options, extended health benefits, unlimited paid vacation, and 401(k) matching.
• Remote work from anywhere in the United States, with occasional travel to Canada.