Senior Compliance Analyst - FedRAMP

CoLab Software

13h•Remote

About The Position

As a Senior Compliance Analyst specializing in FedRAMP, you will serve as the Information System Security Officer (ISSO) for CoLab’s GovCloud environment, which holds a FedRAMP Class D Certification. You will own the full lifecycle of the GovCloud compliance program, including its Certification Package, ongoing certification reporting, significant change processes, and transition to updated FedRAMP requirements. This hands-on role requires strong organization and reports to the Director of Risk and Compliance, independent of the System Owner. The role is remote from anywhere in the United States, with occasional travel to CoLab’s Canadian headquarters. It requires U.S. person status under ITAR (22 CFR 120.62), U.S. residence, and an enhanced background check because the role handles highly sensitive information. This is a full-time, permanent position with a competitive compensation package that includes stock options.

Requirements

6+ years of hands-on experience developing, implementing, and maintaining compliance programs, including 3+ years of direct FedRAMP experience (Moderate/High, now Class B/D).
Working knowledge of NIST SP 800-53, FedRAMP Certification Package documentation, and the 3PAO assessment process.
Ability to plan and complete work within tight deadlines.
Ability to review and interpret technical documentation, regulatory reference materials, and compliance frameworks.
Strong communication and interpersonal skills, with the ability to collaborate with cross-functional teams.
Must be a U.S. person under ITAR (22 CFR 120.62) and based in the United States.
Must pass an enhanced background check.

Nice To Haves

Prior experience as an Information Systems Security Officer or in a similar role for a FedRAMP or FISMA system.
Familiarity with the FedRAMP Consolidated Rules for 2026, including VDR, VER, and SCN, and FedRAMP 20x.
Familiarity with NIST SP 800-171 and CMMC.
Experience with SOC 2 and ISO 27001 frameworks.
Knowledge of U.S. export controls, including ITAR and EAR.
Experience with GRC platforms such as Paramify or Vanta and vulnerability scanning tools such as Nessus.

Responsibilities

Serve as Information System Security Officer for the GovCloud system.
Act as the main compliance point of contact for CoLab’s agency sponsor, the FedRAMP PMO, and CoLab’s 3PAO.
Develop and maintain the Certification Package Overview and Security Decision Record (formerly the System Security Plan, SSP) and its attachments in CoLab’s GRC platform, Paramify.
Maintain NIST SP 800-53 control mappings to the FedRAMP Class D baseline and work with control owners to document control implementation.
Run vulnerability reporting under FedRAMP’s Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules, including persistent agency reporting, monthly human-readable summaries, machine-readable JSON vulnerability history, PAIN-based remediation timelines, and accepted-vulnerability tracking.
Own the Significant Change Notification (SCN) process, including classifying changes as routine, adaptive, or transformative; managing Security Impact Analysis and Change Control Board intake; filing SCNs within FedRAMP deadlines; and maintaining 12 months of SCN history.
Lead CoLab’s transition to new FedRAMP requirements, including VDR/VER adoption, mandatory SCN rules, and the move from Rev5 to FedRAMP 20x; track future rule and guidance changes and prepare the team.
Lead the monthly Ongoing Certification meeting with the agency sponsor and coordinate the annual assessment.
Prepare and schedule 3PAO walkthroughs with control owners.
Participate in FedRAMP assessments and audits by preparing documentation, responding to assessor and agency inquiries, and collecting control evidence.
Own the Integrated Inventory (Appendix M), reconcile it against Nessus scan coverage, and update it whenever the system boundary changes.
Review GovCloud feature eligibility requests with Product and Engineering for compliance impact.
Coordinate responses to customer and agency security inquiries and questionnaires under tight timelines.
Monitor compliance activities to ensure deadlines are met across FedRAMP and other frameworks.
Create and maintain documentation that supports compliance requirements.
Work with Security, Compliance, IT, and Cloud to prioritize and complete operational tasks, including evidence collection and boundary and inventory updates.