Lead Product GRC Subject Matter Expert

🔥 0 minutes ago

🇺🇸 United States – Remote

💵 $230k - $270k / year

⏰ Full Time

🟠 Senior

✅ Product Manager

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Vanta

WebsiteLinkedInAll Job Openings

201 - 500 employees

Founded 2018

📋 Compliance

🔐 Security

☁️ SaaS

💰 $40M Series B on 2022-10

Compliance • Security • SaaS

Vanta is a trust management platform that streamlines compliance workflows and enhances security programs for businesses. By leveraging automation, Vanta helps companies achieve and maintain compliance with frameworks like SOC 2, ISO 27001, and GDPR. It offers solutions for companies of all sizes, from startups to enterprises, ensuring security and compliance at scale. With integrations with over 375 tools, Vanta leverages AI to simplify tasks such as questionnaire automation and vendor risk management. Vanta empowers service providers and auditors to deliver efficient and satisfactory experiences, helping businesses build trust with their clients and partners.

📋 Description

• Lead the creation, enhancement, and lifecycle management of federal compliance controls, evidence requirements, and implementation guidance • Author control rationales, acceptance criteria, and customer-facing guidance as out-of-the-box product content • Interpret 800-53A assessment procedures, 800-53B baselines, organization-defined parameters, and FedRAMP constraints • Decompose controls into technical obligations and resolve inherited, shared, and customer-owned responsibilities • Anchor evidence expectations in PPSM, STIG, and CIS hardening standards and scan outputs • Translate controls and infrastructure context into automated tests and continuous-monitoring detectors • Define test logic, data sources, edge cases, and failure conditions • Partner with Engineering to implement and maintain detectors with versioned framework mappings • Shape machine-readable federal content for OSCAL and FedRAMP 20x • Maintain bidirectional crosswalks across federal compliance frameworks • Partner with Product Management and Design on discovery, UI/UX, PRDs, and acceptance criteria • Partner with Engineering and ML on AI-assisted compliance guidance, evaluation sets, and safety guardrails • Analyze customer, agency, 3PAO, and internal feedback to identify content gaps and ship updates • Mentor and calibrate other SMEs, set content quality standards, and establish framework strategy

🎯 Requirements

• 8–10+ years in GRC and/or Information Security • Hands-on federal compliance experience, including building or maintaining FedRAMP programs on the CSP side • Experience authoring SSPs and supporting artifacts and running continuous monitoring • Fluency with the NIST 800-53/FedRAMP relationship, 800-53A/B, organization-defined parameters, control inheritance, non-applicability, customer responsibility matrices, PPSM, and STIG/CIS benchmarks • Working familiarity with OSCAL or other machine-readable compliance approaches • Ability to turn controls into functional tests with defined pass/failure conditions, evidence sufficiency criteria, and system-component coverage • Ability to translate requirements into productizable capabilities • Current use of AI in GRC work, including AI pair-programming tools, lightweight automations, APIs, webhooks, LLM-assisted workflows, measured outcomes, and safe-use patterns • Precision with control wording, mapping accuracy, and evidence specificity • Comfort with spreadsheets and large datasets • Excellent written and verbal communication skills • Ability to work effectively with engineers, designers, GTM teams, agencies, 3PAOs, and customers • Ability to operate autonomously at Lead level • Open to using AI responsibly to improve efficiency and impact • DoD impact-level IL4/IL5 or CMMC experience is a strong plus • StateRAMP, CNSSI 1253/ICD 503, GovCloud or IL-environment architecture experience, or prior GRC platform product/content experience are nice-to-have • Certifications such as CISSP-ISSEP, CISA, FedRAMP 3PAO assessor credentials (CCP/CCA), or CISM are preferred, not required

🏖️ Benefits

• Industry-competitive salary • Equity • Comprehensive medical, dental, and vision coverage • 100% of employee-only benefit premiums covered for most medical plans • 16 weeks paid Parental Leave for all new parents • Health & wellness stipend • Remote workspace, internet, and cellphone stipend • Commuter benefits for team members who report to the SF and NYC office • Family planning benefits • Matching 401(k) contribution with immediate vesting • Flexible PTO policy • 80 hours of Sick Time • 11 company-paid holidays • Virtual team building activities, lunch and learns, and other company-wide events