# Senior Technical Compliance Analyst **Company**: MongoDB **Location**: United States **Work arrangement**: remote **Experience**: senior **Job type**: full-time **Category**: Security **Industry**: Technology **Apply**: https://job-boards.greenhouse.io/mongodb/jobs/8318378?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/jobs/job_dfe1cfc0-b3a ## Description MongoDB's Compliance team leads the strategy, execution, and maintenance of the company's global security certifications and regulatory requirements. The Senior Technical Compliance Analyst (Public Sector) is a senior-level individual contributor role responsible for the lifecycle management of MongoDB's most sensitive US government authorizations. **Key Responsibilities:** - Lead end-to-end external audits and certifications, coordinating scoping, audit plans, evidence, auditor engagement, findings, and final outcomes - Own internal audit cadences and remediation tracking; establish clear accountability for findings, milestones, dependencies, and resolution timelines, and drive timely follow-through with technical teams - Serve as a lead point of contact for auditors and enterprise customers during security reviews and audit deep-dives; explain MongoDB's control environment with clarity and confidence - Map regulatory requirements to the central control framework and conduct gap analyses for new frameworks, jurisdictions, and market expansions - Assess compliance-program maturity and report material risks, gaps, trends, and delivery status to team and business leaders - Author and review customer-facing security documentation and audit evidence, ensuring it accurately reflects MongoDB's controls and architectural guardrails - Lead cross-functional workstreams that advance the ARC roadmap; identify risks and dependencies early and recommend practical improvements to processes and tooling - Build and maintain executive and operational dashboards and Jira workflows for control performance, audit findings, and remediation progress; mentor stakeholders on compliance practices - Lead the end-to-end execution of federal assessments, coordinating with Third Party Assessment Organizations (3PAOs), agency sponsors, and the FedRAMP PMO - Manage the federal continuous monitoring (ConMon) program, including the timely analysis and reporting of vulnerabilities and the maintenance of the POA&M - Lead the annual update and technical review of core FedRAMP artifacts, including the System Security Plan (SSP), Contingency Plan (ISCP), and Incident Response Plan (IRP) - Act as a technical advisor to Engineering and Operations teams to ensure cloud configurations meet federal and DoD IL5+ mandates **Expectations:** - Operate independently in ambiguous, complex situations and exercise sound judgment with minimal supervision - Take accountability for program outcomes,not only task tracking,and proactively surface risks, trade-offs, and decisions that require escalation - Influence technical and business stakeholders across teams and levels to deliver sustainable compliance outcomes - Communicate regulatory intent and technical control requirements in concise, actionable language for both technical and non-technical audiences **Scope and Complexity:** The role manages overlapping audit cycles and compliance work across international jurisdictions and across highly regulated sectors such as financial services, healthcare, and government. Work ranges from complex evidence and control assessments to interpreting emerging requirements and identifying how controls can satisfy multiple standards. **Authority and Impact:** The Senior Compliance Analyst has the authority to lead federal assessment project streams and represent MongoDB in technical reviews with 3PAOs and federal agencies. Your work directly enables MongoDB to secure and maintain the authorizations required to serve the Department of Defense and civilian agencies, protecting a critical revenue stream. **Expertise and Leadership:** The role develops deep subject-matter expertise in assigned frameworks and in how MongoDB's cloud architecture satisfies their requirements. It serves as a trusted resource for mapping technical evidence to regulatory intent, leads complex projects such as internal audits and framework renewals, and mentors colleagues and partner teams on effective compliance practices. **Requirements:** - Bachelor's degree in a technical field (such as Information Systems, Computer Science, or Cybersecurity), or equivalent practical experience - 7+ years of experience in GRC, Information Security, or IT Audit, preferably in a SaaS or cloud environment, with a heavy focus on US Public Sector frameworks (FedRAMP, DoD SRG, CJIS) - Demonstrated experience leading technical audits or compliance programs - Strong understanding of cloud security principles, risk management, and how controls operate in a cloud-native environment across AWS, Google Cloud, or Azure - Deep understanding of NIST 800-53 and NIST 800-171 controls and how they are implemented within cloud architectures (AWS, GCP, or Azure) - Proven track record of managing federal audits from kickoff through to the issuance of an Authorization to Operate (ATO) - Exceptional ability to explain complex security configurations to government auditors and internal technical teams - Advanced proficiency in Jira and Confluence to track control performance data and manage large-scale federal documentation projects - Practical experience performing control mapping, gap analyses, remediation oversight, and program or control-maturity assessments - Advanced proficiency with Jira or similar tools for managing audit findings, control data, and high-volume remediation workflows - Excellent written and verbal communication skills, including the ability to lead auditor/customer discussions and translate technical requirements for non-technical audiences - Certifications such as CISA, CRISC, CISSP, or ISO Lead Implementer are preferred ## Skills ### Required - GRC - Information Security - IT Audit - Cloud Security - Risk Management - NIST 800-53 - NIST 800-171 - Jira - Confluence - Control Mapping - Gap Analyses - Remediation Oversight - Program Assessments ### Nice to have - CISA - CRISC - CISSP - ISO Lead Implementer --- Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/mongodb/jobs/8318378?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)