Senior Technical Compliance Analyst

MongoDB•New York, NY

2d•$95,000 - $187,000•Remote

About The Position

MongoDB’s Compliance team leads the strategy, execution, and maintenance of the company’s global security certifications and regulatory requirements. The Senior Technical Compliance Analyst (Public Sector) is a senior individual-contributor role responsible for lifecycle management of MongoDB’s most sensitive U.S. government authorizations, including FedRAMP High, DoD IL5+, CJIS, and ITAR. The position owns complex federal assessments and leads continuous monitoring for the Atlas for Government product. It interprets NIST 800-53 controls and translates them into technical requirements for engineering teams. U.S. citizenship is required. The role is remote within the United States. The position leads external audits, internal audit cadences, federal assessments, and continuous monitoring; represents MongoDB in technical reviews with auditors, customers, 3PAOs, and federal agencies; and works with Engineering, Operations, Product, and Legal teams to maintain compliant, audit-ready systems. It also maps controls across overlapping frameworks, maintains federal compliance artifacts, tracks remediation, and advises teams on cloud configurations and technical control requirements. The role operates independently in complex and ambiguous situations, takes accountability for program outcomes, influences stakeholders across teams, and communicates regulatory and technical requirements clearly to technical and non-technical audiences. Its work enables MongoDB to obtain and maintain authorizations required to serve U.S. Department of Defense and civilian agencies. MongoDB describes its platform as a unified, globally distributed, multi-cloud data platform available across AWS, Google Cloud, and Microsoft Azure. The company reports more than 67,000 customers, including approximately 75% of the Fortune 100. For eligible U.S.-based employees, the compensation package may include equity, employee stock purchase plan participation, flexible paid time off, paid parental leave, fertility and adoption assistance, a 401(k) plan, mental health counseling, transgender-inclusive health insurance coverage, and health benefits offerings.

Requirements

Bachelor’s degree in a technical field such as Information Systems, Computer Science, or Cybersecurity, or equivalent practical experience.
7+ years of experience in GRC, Information Security, or IT Audit, preferably in a SaaS or cloud environment, with a heavy focus on U.S. public-sector frameworks such as FedRAMP, DoD SRG, and CJIS.
Demonstrated experience leading technical audits or compliance programs.
Strong understanding of cloud security principles, risk management, and how controls operate in a cloud-native environment across AWS, Google Cloud, or Azure.
Deep understanding of NIST 800-53 and NIST 800-171 controls and their implementation within cloud architectures.
Proven track record managing federal audits from kickoff through issuance of an Authorization to Operate (ATO).
Exceptional ability to explain complex security configurations to government auditors and internal technical teams.
Advanced proficiency in Jira and Confluence to track control performance data and manage large-scale federal documentation projects.
Practical experience performing control mapping, gap analyses, remediation oversight, and program or control-maturity assessments.
Advanced proficiency in Jira or similar tools for managing audit findings, control data, and high-volume remediation workflows.
Excellent written and verbal communication skills, including leading auditor and customer discussions and translating technical requirements for non-technical audiences.
U.S. citizenship is required.

Nice To Haves

Certifications such as CISA, CRISC, CISSP, or ISO Lead Implementer.

Responsibilities

Lead end-to-end external audits and certifications, including scoping, audit plans, evidence, auditor engagement, findings, and final outcomes.
Own internal audit cadences and remediation tracking; establish accountability for findings, milestones, dependencies, and resolution timelines, and drive timely follow-through with technical teams.
Serve as a lead point of contact for auditors and enterprise customers during security reviews and audit deep-dives, explaining MongoDB’s control environment.
Map regulatory requirements to the central control framework and conduct gap analyses for new frameworks, jurisdictions, and market expansions.
Assess compliance-program maturity and report material risks, gaps, trends, and delivery status to team and business leaders.
Author and review customer-facing security documentation and audit evidence to ensure they accurately reflect MongoDB’s controls and architectural guardrails.
Lead cross-functional workstreams advancing the ARC roadmap; identify risks and dependencies and recommend process and tooling improvements.
Build and maintain executive and operational dashboards and Jira workflows for control performance, audit findings, and remediation progress; mentor stakeholders on compliance practices.
Lead end-to-end federal assessments, coordinating with Third Party Assessment Organizations (3PAOs), agency sponsors, and the FedRAMP PMO.
Manage the federal continuous monitoring program, including vulnerability analysis and reporting and maintenance of the POA&M.
Lead the annual update and technical review of FedRAMP artifacts, including the System Security Plan (SSP), Contingency Plan (ISCP), and Incident Response Plan (IRP).
Advise Engineering and Operations teams on cloud configurations, including FIPS 140-2, boundary protection, and access control, to meet federal and DoD IL5+ mandates.
Represent MongoDB in technical reviews with 3PAOs and federal agencies and lead federal assessment project streams.
Mentor colleagues and partner teams on effective compliance practices.