Principal, Public Sector Compliance

Cohesity•Washington, DC

4d•$198,000 - $247,500•Hybrid

About The Position

Cohesity is a leader in AI-powered data security and management. We are seeking a Principal, Public Sector Compliance to own our public sector authorization portfolio, including FedRAMP Class C (Rev5), GovRAMP Moderate, and CMMC Level 1 and Level 2. This is a named-ownership role where you will maintain and advance our FedRAMP certification through continuous monitoring and annual assessments, lead the organization through mandatory 2026-2027 regulatory transitions, and shape a federal product roadmap. You will operate at the intersection of compliance, engineering, and product, with full operating autonomy and significant cross-functional influence.

Requirements

8–10 years of hands-on FedRAMP program experience, including named ownership of a Cloud Service Provider authorization through multiple full 3PAO assessment cycles at Moderate and High impact levels.
Direct accountability for the SSP, Collaborative ConMon, POA&M, significant change management, and 3PAO.
Operational depth in continuous monitoring, including POA&M management, vulnerability management, ConMon deliverable production, and federal agency sponsor relationship management.

Responsibilities

Own authorization integrity. Maintain Cohesity’s FedRAMP Class C, GovRAMP Moderate, and CMMC L1/L2 certifications. Lead continuous monitoring (ConMon) efforts and maintenance of required documentation.
Govern the authorized boundary. Manage the significant change process, including review and sign off on changes, and ensuring engineering and infrastructure teams understand what triggers a formal notification requirement.
Lead regulatory transitions. Drive adoption of FedRAMP's Consolidated Rules, including new VDR/VER rulesets, and develop a defensible Rev5-to-20x conversion recommendation. Stay informed about evolving framework requirements and translate operational implications to leadership.
Own assessment cycles. Serve as the primary interface for third-party assessors across annual FedRAMP and GovRAMP assessments and the triennial CMMC Level 2 assessment — readiness, facilitation, evidence gathering, and finding remediation.
Translate compliance into engineering guidance. Convert control requirements into acceptance criteria that engineering and cloud operations teams can act on, and challenge implementations that fall short.
Shape the federal offering. Partner with Product Management and Federal Sales to deliver a compliant offering that supports business growth and drives competitive advantage.
Build the AI-enabled compliance program. Own machine-readable, AI-consumable artifact schemas, set the evidentiary standard automated work must meet, and help move the program from human-heavy to agent- leveraged operations.