Compliance Operations Lead

What You'll Do

• Build and run the master compliance program covering FedRAMP High, IL5, CMMC Level 2, SOC 2, and adjacent public-sector frameworks; maintain a forward-looking roadmap anticipating new frameworks, customer requirements, and regulatory changes.
• Drive the FedRAMP High ATO roadmap end-to-end, including 3PAO coordination, agency sponsorship navigation, and continuous monitoring once authorized.
• Own evidence management end-to-end: implement automated policy checks, control evidence capture, and continuous monitoring tooling to remain audit-ready daily.
• Lead quarterly and annual security documentation cycles, coordinate penetration tests and red-team engagements, and track remediation to closure.
• Serve as the primary voice on enterprise security questionnaires and customer trust calls; join pitches and discovery calls, brief prospects on compliance roadmap, represent at industry and federal/defense forums, and build a customer-facing trust center and reusable response library.
• Embed secure-by-design practices with engineering, including policy checks in CI/CD, infrastructure-as-code guardrails, and hardened deployment pipelines; monitor threat landscape and propose proactive hardening measures.

What You Bring

• 3+ years leading compliance or security programs at a high-growth technology or defense startup, comfortable in fast-moving, early-stage environments.
• Demonstrated success achieving and maintaining FedRAMP High ATO or equivalent high-impact authorization; experience building a compliance program from scratch.
• Deep working fluency with IL5, CMMC Level 2, SOC 2 Type II, NIST 800-171, and the broader U.S. public-sector compliance landscape.
• Proven ability to design and run automated evidence collection, policy management, and vulnerability-tracking workflows; experience coordinating red-team, penetration-test, or bug-bounty programs and translating findings into engineering action.
• Ability to write policy and read code; translate effectively between auditors and senior engineers.
• Strong written and verbal communication for technical and executive audiences; comfortable owning customer security reviews end-to-end.

Nice-to-Haves

• Hands-on exposure to Kubernetes, Terraform, JAMF, and modern DevSecOps toolchains.
• Prior experience supporting an IC or DoD customer base.
• Background in government contracting, the military, or the intelligence community.

Compensation & Benefits

• Base Salary: $140,000 – $190,000
• Equity: Meaningful stake in a well-funded, fast-growing startup
• Benefits: medical, vision, and dental; unlimited PTO
• Brooklyn Navy Yard office (3+ days/week in person)