Security Compliance Lead, FedRAMP

As a Security Risk and Compliance Lead, you will play a hands-on role in maturing and operating Asana's compliance and certification programme,with a primary focus on FedRAMP Continuous Monitoring and authorization activities.

This role sits at the intersection of traditional GRC work and compliance engineering: you will own our FedRAMP programme day-to-day, while also supporting our broader audit cycles and control frameworks across SOC 2 and ISO 27001.

FedRAMP Continuous Monitoring

• Own the monthly FedRAMP ConMon package submission, ensuring it is accurate, complete, and delivered on time every month.
• Track and drive completion of all time-bound FedRAMP requirements by working closely with Engineering, People, and other responsible teams.
• Maintain a clear calendar of FedRAMP deliverables and proactively flag risks to timelines, escalating where needed to ensure nothing slips.
• Serve as the internal subject matter expert for FedRAMP, acting as the day-to-day point of contact for FedRAMP-related queries from internal teams and helping them understand their obligations and what good looks like.
• Proactively engage with a wide range of teams,including Engineering, IT, and People,to work through FedRAMP controls maturity activities, close existing gaps, and drive remediation efforts to completion with clear documentation of progress.

Controls Maturity & Broader Certifications

• Support the maintenance and continuous improvement of Asana's broader control framework across SOC 2, ISO 27001, and other applicable standards.
• Support external compliance audits end-to-end: coordinating evidence requests, liaising with auditors, and tracking findings through to closure.
• Contribute to controls maturity scoring and reporting, providing ongoing visibility into programme health for senior leadership.
• Build strong working relationships across the business so that control owners feel supported and accountability is shared, not siloed within the compliance team.

Evidence Collection & Automation

• Own evidence collection workflows within our GRC platform, ensuring controls are reliably mapped, evidence is current, and audit artefacts are ready year-round,with particular attention to FedRAMP requirements.
• Document evidence collection procedures so that processes are transparent, auditable, and maintainable by the broader team.
• Where possible, identify opportunities to automate repetitive evidence-gathering tasks,curiosity and initiative here will be valued, though this is not a core requirement of the role.

About You

• 5+ years of experience in Governance, Risk, and Compliance (GRC), information security, or a closely related field,internships and co-ops count.
• Hands-on experience with FedRAMP,ideally including ConMon, evidence collection, or working within a FedRAMP Moderate or High boundary.
• Foundational knowledge of broader security compliance frameworks such as SOC 2, ISO 27001, or NIST CSF is a plus, but depth in FedRAMP matters most.
• Organised and deadline-driven: you can manage multiple workstreams, track time-sensitive obligations (like monthly FedRAMP submissions), and keep audit artefacts tidy without being reminded.
• Comfortable engaging with a wide variety of teams,Engineering, People, IT, Legal,to explain compliance requirements, gather evidence, and build the relationships needed to close control gaps.
• A clear communicator who can translate compliance requirements into plain language for both technical and non-technical stakeholders.
• Exposure to compliance automation or evidence collection tooling (GRC platforms, scripting, API integrations) is a plus, but not essential,curiosity and a willingness to grow technically matter more.
• Curious about how modern SaaS engineering works,comfortable asking questions and learning the technical context behind a control.
• Demonstrates curiosity about AI tools and emerging technologies, with a willingness to learn and leverage them to enhance productivity, collaboration, or decision-making.

What We’ll Offer

• Estimated base salary range: $158,000–$180,000.
• Comprehensive compensation package, including equity and benefits.
• Mental health, wellness & fitness benefits.
• Career coaching & support.
• Inclusive family building benefits.
• Long-term savings or retirement plans.
• In-office culinary options to cater to your dietary preferences.