# Security Compliance Lead, FedRAMP **Company**: Asana **Location**: San Francisco **Work arrangement**: hybrid **Experience**: senior **Job type**: full-time **Salary**: $158,000–$180,000 **Category**: Security **Industry**: Technology **Apply**: https://job-boards.greenhouse.io/asana/jobs/7821582?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/jobs/job_1e0bd719-886 ## Description As a Security Risk and Compliance Lead, you will play a hands-on role in maturing and operating Asana's compliance and certification programme,with a primary focus on FedRAMP Continuous Monitoring and authorization activities. This role sits at the intersection of traditional GRC work and compliance engineering: you will own our FedRAMP programme day-to-day, while also supporting our broader audit cycles and control frameworks across SOC 2 and ISO 27001. **FedRAMP Continuous Monitoring** - Own the monthly FedRAMP ConMon package submission, ensuring it is accurate, complete, and delivered on time every month. - Track and drive completion of all time-bound FedRAMP requirements by working closely with Engineering, People, and other responsible teams. - Maintain a clear calendar of FedRAMP deliverables and proactively flag risks to timelines, escalating where needed to ensure nothing slips. - Serve as the internal subject matter expert for FedRAMP, acting as the day-to-day point of contact for FedRAMP-related queries from internal teams and helping them understand their obligations and what good looks like. - Proactively engage with a wide range of teams,including Engineering, IT, and People,to work through FedRAMP controls maturity activities, close existing gaps, and drive remediation efforts to completion with clear documentation of progress. **Controls Maturity & Broader Certifications** - Support the maintenance and continuous improvement of Asana's broader control framework across SOC 2, ISO 27001, and other applicable standards. - Support external compliance audits end-to-end: coordinating evidence requests, liaising with auditors, and tracking findings through to closure. - Contribute to controls maturity scoring and reporting, providing ongoing visibility into programme health for senior leadership. - Build strong working relationships across the business so that control owners feel supported and accountability is shared, not siloed within the compliance team. **Evidence Collection & Automation** - Own evidence collection workflows within our GRC platform, ensuring controls are reliably mapped, evidence is current, and audit artefacts are ready year-round,with particular attention to FedRAMP requirements. - Document evidence collection procedures so that processes are transparent, auditable, and maintainable by the broader team. - Where possible, identify opportunities to automate repetitive evidence-gathering tasks,curiosity and initiative here will be valued, though this is not a core requirement of the role. **About You** - 5+ years of experience in Governance, Risk, and Compliance (GRC), information security, or a closely related field,internships and co-ops count. - Hands-on experience with FedRAMP,ideally including ConMon, evidence collection, or working within a FedRAMP Moderate or High boundary. - Foundational knowledge of broader security compliance frameworks such as SOC 2, ISO 27001, or NIST CSF is a plus, but depth in FedRAMP matters most. - Organised and deadline-driven: you can manage multiple workstreams, track time-sensitive obligations (like monthly FedRAMP submissions), and keep audit artefacts tidy without being reminded. - Comfortable engaging with a wide variety of teams,Engineering, People, IT, Legal,to explain compliance requirements, gather evidence, and build the relationships needed to close control gaps. - A clear communicator who can translate compliance requirements into plain language for both technical and non-technical stakeholders. - Exposure to compliance automation or evidence collection tooling (GRC platforms, scripting, API integrations) is a plus, but not essential,curiosity and a willingness to grow technically matter more. - Curious about how modern SaaS engineering works,comfortable asking questions and learning the technical context behind a control. - Demonstrates curiosity about AI tools and emerging technologies, with a willingness to learn and leverage them to enhance productivity, collaboration, or decision-making. **What We’ll Offer** - Estimated base salary range: $158,000–$180,000. - Comprehensive compensation package, including equity and benefits. - Mental health, wellness & fitness benefits. - Career coaching & support. - Inclusive family building benefits. - Long-term savings or retirement plans. - In-office culinary options to cater to your dietary preferences. ## Skills ### Required - FedRAMP - GRC - SOC 2 - ISO 27001 - NIST CSF ### Nice to have - compliance automation - evidence collection tooling - GRC platforms - scripting - API integrations - Spanish --- Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/asana/jobs/7821582?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)