Senior GRC Analyst - FedRAMP & Cloud Security (Remote)

VulnU; United States; Remote; USD 215,000 - 230,000; Full time

Benefits offered by this job

Equity

Job summary

Tines is seeking a Staff GRC Analyst to bridge technical engineering teams and external auditors. The role collaborates with Security, Engineering, Product, IT, and Legal to convert regulatory requirements into practical controls across multi-cloud environments.

The ideal candidate will own their area of responsibility, drive remediation, support FedRAMP authorization and audits, and scale compliance through automation and policy-as-code.

Qualifications

• 12+ years' experience in security compliance, technical GRC, cloud security, IT audit, or related technical governance roles.
• Hands-on experience translating compliance requirements into technical controls and configuration standards.
• Strong knowledge of cloud/SaaS security (IAM, encryption, logging, vulnerability management, secure SDLC).
• Experience supporting FedRAMP authorization, ConMon, POA&M management, and external assessments.

Responsibilities

• Translate FedRAMP High, DoD IL4/IL5, CMMC, NIST SP 800-53/800-171, SOC 2, ISO requirements into actionable technical controls across AWS and Azure.
• Assess technical implementations across infrastructure, networking, containers, databases, IAM, encryption, logging, and vulnerability management.
• Define evidence requirements and validate control implementations with technical teams; drive remediation.
• Support FedRAMP authorization and ongoing operations, including ConMon, POA&M management, vulnerability reporting, evidence packages, and change management.
• Support external assessments and audits, including 3PAO engagements and audit readiness.
• Monitor evolving federal requirements and identify opportunities to scale compliance through automation and policy-as-code.

Skills

Technical GRC

Cloud Security

FedRAMP

Audit Support

IAM & Encryption

Job description

Tines is seeking a Staff GRC Analyst to bridge technical engineering teams and external auditors. The role collaborates with Security, Engineering, Product, IT, and Legal to convert regulatory requirements into practical controls across multi-cloud environments.

The ideal candidate will own their area of responsibility, drive remediation, support FedRAMP authorization and audits, and scale compliance through automation and policy-as-code.