产品GRC专家, (V4G)
Product GRC Subject Matter Expert, (V4G)
在 Vanta，我们的使命是帮助企业在获得并证明信任方面取得成功。我们相信安全应持续监控和验证，我们赋能企业实践更好的安全措施，并轻松证明其安全性。Vanta 有一支善良且才华横溢的团队，虽然一些人有之前的安全经验，但许多人没有相关经验也能在 Vanta 取得成功。
Vanta for Government（V4G）是我们将这一使命带入公共部门的方式。随着联邦合规性经历十年来最大的转变——FedRAMP 20x、可机器读取的授权、OSCAL——我们正在构建一个平台，将联邦框架转化为自动化、持续监控的产品体验。该团队的 GRC 专家是实现这一目标的人。
作为 Vanta 的 V4G GRC 专家，你将负责每个在我们平台上寻求或维持联邦授权的客户所使用的联邦合规内容。这是一项解释和编写的工作，而不是合规程序管理的工作：你的工作是解释底层控制要求，识别 FedRAMP 如何修改或限制 NIST 框架，并将这些解释转化为精确、技术上可测试的指导，供工程团队开发，供客户执行。你编写的文档会作为产品发布——一家五人初创公司和一家财富 100 强的 CSP 都会收到它——因此校准深度、精确度和通用性是核心技能。
你将加入 Vanta 的安全团队，该团队直接影响产品开发，推动自动化 GRC 解决方案的创建，并为公司内部提供专家咨询服务。
你在 Vanta 作为 V4G GRC 专家的工作内容包括：
- 构建并负责联邦合规框架 —— 领导 FedRAMP（Low/Moderate/High）、NIST SP 800-53、NIST SP 800-171、CMMC、DFARS 和 StateRAMP 的控制、证据要求和实施指南的创建、增强和生命周期管理。撰写清晰的控制理由、接受标准和面向客户的指导，作为开箱即用的产品内容发布。
- 在机制层面解释控制要求 —— 熟练掌握 800-53A 评估流程和 800-53B 基线；解决组织定义的参数和 FedRAMP 对它们的限制；将控制分解为独立的技术义务；正确解析客户责任矩阵中的继承、共享和客户所有责任；并将证据期望锚定在作者的规范中
查看英文原文
At Vanta, our mission is to help businesses earn and prove trust. We believe that security should be monitored and verified continuously, and we empower companies to practice better security and prove it with ease. Vanta has a kind and talented team, and while some have prior security experience, many have been successful at Vanta without it.
Vanta for Government (V4G) is how we bring that mission to the public sector. As federal compliance undergoes its biggest shift in a decade — FedRAMP 20x, machine-readable authorization, OSCAL — we're building the platform that turns federal frameworks into automated, continuously monitored product experiences. The GRC Subject Matter Experts on this team are the people who make that possible.
As Vanta's GRC Subject Matter Expert for V4G, you'll own federal compliance content used by every customer pursuing or maintaining federal authorization on our platform. This is an interpretation-and-authoring role, not a compliance program administration role: your job is to interpret underlying control requirements, identify where FedRAMP modifies or constrains the NIST framework, and translate those interpretations into precise, technically testable guidance that engineering can build and customers can act on. The content you write ships as product — a five-person startup and a Fortune 100 CSP both receive it — so calibrating depth, precision, and universality is the core craft.
You'll join Vanta's Security organization, which directly influences product development, facilitates the creation of automated GRC solutions for customers, and provides expert advisory services across the company.
What you’ll do as a V4G GRC SME at Vanta:
- Build and own federal compliance frameworks — Lead the creation, enhancement, and lifecycle management of controls, evidence requirements, and implementation guidance for FedRAMP (Low/Moderate/High), NIST SP 800-53, NIST SP 800-171, CMMC, DFARS, and StateRAMP. Author clear control rationales, acceptance criteria, and customer-facing guidance shipped as out-of-the-box product content.
- Interpret controls at the mechanics level — Work fluently with 800-53A assessment procedures and 800-53B baselines; resolve organization-defined parameters and FedRAMP's constraints on them; decompose controls into distinct technical obligations; correctly resolve inherited, shared, and customer-owned responsibilities within a customer responsibility matrix; and anchor evidence expectations in authoritative artifacts (PPSM, STIG and CIS hardening standards and their scan outputs across operating systems, databases, network devices, and endpoints).
- Author automated tests & continuous monitoring — Translate controls and infrastructure context (AWS GovCloud, Azure Government, GCP, SaaS, endpoints, CI/CD) into spec-level automated tests and detectors. Define test logic, data sources, edge cases, and — critically — failure conditions: how unapproved items, exceptions, missing data, and unevaluated resources affect a result. Pair with Engineering to implement and maintain detectors with versioned framework mappings.
- Lead V4G's machine-readable future — Shape how Vanta's federal content is architected for OSCAL and FedRAMP 20x: machine-readable SSPs, config-as-compliance, and continuous authorization workflows.
- Design crosswalks and mappings — Maintain bidirectional crosswalks across federal frameworks (800-53 ↔ 800-171 ↔ CMMC ↔ StateRAMP) with canonical control IDs, mapping confidence, and traceability to source authority.
- Act as a product advisor across discovery & design — Partner with the V4G PM and Design on feature discovery, review UI/UX for control, evidence, and authorization workflows, and author PRDs and acceptance criteria grounded in agency, auditor, and 3PAO needs.
- Enable AI-assisted compliance — Partner with Engineering/ML to design LLM-powered guidance and automation for federal workflows. Translate SME knowledge into machine-readable specs, define gold-standard evaluation sets, and implement quality and safety guardrails.
- Synthesize feedback loops — Analyze input from customers, agencies, 3PAOs, and internal teams to identify content gaps and ship iterative updates quickly and safely.
- Raise the bar — Mentor and calibrate other SMEs, set content quality standards for the federal portfolio, and set framework strategy that others execute against.
How to be successful in this role:
- Experience — 8–10+ years in GRC and/or Information Security with hands-on federal compliance work: building or maintaining FedRAMP programs on the CSP side, authoring SSPs and supporting artifacts, and running continuous monitoring. DoD impact-level (IL4/IL5) or CMMC experience is a strong plus. Note: this is a builder role — candidates whose federal experience is primarily assessment (3PAO) or compliance program coordination will find the day-to-day is materially different from that work.
- Federal interpretation depth — Demonstrated fluency with the NIST 800-53/FedRAMP relationship, 800-53A/B, organization-defined parameters, control inheritance vs. non-applicability, customer responsibility matrices, PPSM, and STIG/CIS benchmarks.
- OSCAL & FedRAMP 20x — Working familiarity with OSCAL or other machine-readable compliance approaches, and an informed point of view on where federal authorization is heading.
- Test-design rigor — Ability to turn a control into a functional test with defined pass and failure conditions, evidence sufficiency criteria, and coverage across relevant system components.
- Product mindset — Ability to translate requirements into productizable capabilities usable by organizations of every size; comfort with experimentation and data-driven prioritization.
- Technical & automation (AI-augmented) — Active, current use of AI in GRC work: AI pair-programming tools to accelerate specs, mappings, and test logic; lightweight automations across Sheets/Airtable, APIs, and webhooks; AI-augmented workflows (LLM-assisted control guidance, cross-framework mapping, evidence triage) with measured outcomes; and safe-use patterns for prompts and agents.
- Analytical & detail-oriented — Precise control wording, mapping accuracy, and evidence specificity; comfortable in spreadsheets and large datasets.
- Communication & collaboration — Excellent written and verbal skills; effective with engineers, designers, GTM teams, agencies, 3PAOs, and customers.
- Self-motivated and independent — Operates autonomously at Lead level, setting direction rather than awaiting it.
- Nice-to-have — StateRAMP, CNSSI 1253/ICD 503, GovCloud or IL-environment architecture experience, or prior product/content roles at a GRC platform.
- Certifications (preferred, not required) — One or more of: CISSP-ISSEP, CISA, FedRAMP 3PAO assessor credentials (CCP/CCA), CISM, or equivalent experience.
- Open to using AI to amplify their skills and strengthen their work - demonstrating curiosity, a willingness to learn, and sound judgment in applying AI responsibly to improve efficiency and impact.
What you can expect as a Vanta’n:
- Industry-competitive salary and equity
- Comprehensive medical, dental, and vision coverage, with 100% of employee-only benefit premiums covered for most medical plans
- 16 weeks paid Parental Leave for all new parents
- Health & wellness stipend
- Remote workspace, internet, and cellphone stipend
- Commuter benefits for team members who report to the SF and NYC office
- Family planning benefits
- Matching 401(k) contribution with immediate vesting
- Flexible PTO policy, plus 80 hours of Sick Time
- 11 company-paid holidays
- Virtual team building activities, lunch and learns, and other company-wide events!
- Offices in SF, NYC, London, Dublin, Tel Aviv, and Sydney
To provide greater transparency to candidates, we share base pay ranges for all US-based job postings regardless of state. We set standard base pay ranges for all roles based on function, level, and country location, benchmarked against similar-stage growth companies. Final offer amounts are determined by multiple factors and may vary based on candidate location, skills, depth of work experience, and relevant licenses/credentials.
#LI-remote
At Vanta, we are committed to hiring diverse talent of different backgrounds and as such, it is important to us to provide an inclusive work environment for all. We do not discriminate on the basis of race, gender identity, age, religion, sexual orientation, veteran or disability status, or any other protected class. As an equal opportunity employer, we encourage and welcome people of all backgrounds to apply.
About Vanta
We started in 2018, in the wake of several high-profile data breaches. Online security was only becoming more important, but we knew firsthand how hard it could be for fast-growing companies to invest the time and manpower it takes to build a solid security foundation. Vanta was inspired by a vision to restore trust in internet businesses by enabling companies to improve and prove their security. From our early days automating security monitoring for compliance standards like SOC 2, HIPAA and ISO 27001 to creating the world's leading Trust Management Platform, our vision remains unchanged.
Now more than ever, making security continuous—not just a point-in-time check— is essential. Thousands of companies rely on Vanta to build, maintain and demonstrate their trust— all in a way that's real-time and transparent.
Referral Instructions
If you are being referred for the role, please contact that person to apply on your behalf.