Governance, Risk & Compliance (GRC) Analyst

Gallatin•Washington, DC

About The Position

Gallatin is seeking a hands-on GRC Analyst to build and operate the security compliance program that enables its AI platforms to be deployed within Department of Defense environments. The analyst will drive systems from product development through authorization to operate, maintain compliance with NIST SP 800-171 and CMMC, and ensure customer data is governed appropriately. The role works across engineering teams, customer ISSMs and authorizing officials, assessors, and company leadership, translating security requirements into implementable work and producing evidence that supports assessments. The position leads RMF authorization packages and owns related artifacts, including System Security Plans, Plans of Action & Milestones, FedRAMP documentation, and continuous monitoring plans. It manages compliance programs, audits, risk registers, third-party risk, cloud authorization efforts, and remediation. The analyst also partners with Engineering and SRE to embed security controls and automate compliance evidence collection. Active Secret clearance is required; Top Secret / SCI eligibility is preferred, and the candidate must be able to work in a classified environment when necessary.

Requirements

Active Secret clearance and ability to obtain and maintain Top Secret / SCI.
At least 3 years of experience in GRC, cybersecurity compliance, or information assurance; DoD or federal systems experience is preferred.
Direct experience supporting software authorizations at IL4, IL5, or IL6.
Hands-on experience with the DoD RMF process (DoDI 8510.01) and authoring SSPs, POA&Ms, and control implementation statements.
Working knowledge of NIST SP 800-53, NIST SP 800-171, CMMC, and CUI handling requirements (DoDI 5200.48).
Working knowledge of the FedRAMP authorization process, baselines, and package requirements, as well as the DoD Cloud Computing SRG and Impact Levels.
Track record of working directly with government stakeholders, including ISSMs, AOs, or assessors, and moving packages to approval.
Ability to work cross-functionally with engineers and understand cloud architecture sufficiently to assess and document controls accurately.
Familiarity with eMASS, GRC platforms, and cloud security tooling such as AWS GovCloud or Azure Government.
Clear, precise writing and sound judgment in determining whether a control is genuinely met.
Willingness to travel 10–25% to customer and government sites.
Ability to work in a classified environment when necessary.
U.S. citizenship; proof of citizenship is required prior to employment if selected.

Nice To Haves

Security certifications such as CISSP, CISM, CAP/CGRC, Security+, or CMMC Certified Professional/Assessor.
Experience taking an AI/ML or SaaS product through a DoD authorization or FedRAMP process.
Direct experience supporting FedRAMP authorizations at a cloud service provider or a 3PAO.
Experience in a startup or early-stage environment.
Military or government background in cybersecurity, information assurance, or logistics.
Experience with policy-as-code or compliance automation tooling.

Responsibilities

Drive RMF authorization packages for Gallatin products deployed across DoD environments, from system categorization and control selection through assessment and ATO.
Own and maintain the System Security Plan (SSP), Plans of Action & Milestones (POA&Ms), and supporting authorization artifacts as systems and deployments change.
Serve as the day-to-day counterpart to customer ISSMs, ISSOs, and assessors; answer questions, close findings, and keep authorizations on schedule.
Coordinate data-sharing agreements and interconnection documentation with government partners and adjacent programs.
Build and maintain compliance posture against NIST SP 800-171, CMMC Level 2, and NIST SP 800-53, with consideration for FedRAMP and DoD Impact Level requirements.
Run continuous monitoring, including control testing, evidence collection, vulnerability and scan-result tracking, and remediation follow-through with engineering.
Write and maintain security policies, procedures, and standards that reflect company operations.
Prepare for and lead internal audits and third-party assessments.
Lead FedRAMP readiness and authorization, from readiness assessment and boundary definition through agency sponsorship and authorization.
Map cloud architecture to FedRAMP Moderate and High baselines and DoD Cloud Computing SRG Impact Levels, identify gaps, and drive remediation with Engineering.
Develop and maintain the FedRAMP package, including the SSP and appendices, control implementation summaries, and continuous monitoring plan.
Coordinate with Third Party Assessment Organizations (3PAOs) and agency sponsors during assessment.
Track FedRAMP program changes, including FedRAMP 20x and Rev. 5 baseline updates, and advise leadership on authorization paths.
Maintain the risk register and identify, assess, and track security and compliance risks across products, infrastructure, and vendors.
Evaluate third-party and supply-chain risk for tools, services, and partners used in company environments.
Brief leadership on risk posture, open findings, and remediation-priority tradeoffs.
Partner with Engineering and SRE to embed security controls into infrastructure-as-code, CI/CD, and deployment workflows.
Use modern tooling and AI to automate evidence collection and documentation and accelerate authorization work.
Support growth and proposals with security questionnaires, compliance responses, and capability statements.