Role overview

CoLab is seeking a Senior Compliance Analyst to serve as the Information System Security Officer (ISSO) for its GovCloud environment, which holds FedRAMP Class D Certification. CoLab builds AI-powered software for mechanical engineering teams at companies like Bombardier and GE Appliances, helping them bring complex products to market faster. In this hands-on role, you will own the complete lifecycle of CoLab’s GovCloud compliance program and report to the Director of Risk and Compliance.

Key responsibilities

Serve as Information System Security Officer and primary compliance contact for the agency sponsor, FedRAMP PMO, and Third Party Assessment Organization.
Develop and maintain the Certification Package Overview, Security Decision Record, and NIST SP 800-53 control mappings to the FedRAMP Class D baseline using the GRC platform.
Manage vulnerability reporting under FedRAMP’s Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rules, including persistent agency reporting and monthly summaries.
Own the Significant Change Notification process, classifying changes and running Security Impact Analysis and Change Control Board intake within FedRAMP deadlines.
Lead CoLab’s transition to new FedRAMP requirements, including VDR/VER adoption planned for December 2026 and the move to FedRAMP 20x standards.
Coordinate monthly Ongoing Certification meetings with the agency sponsor and lead preparation for annual assessments and Third Party Assessment Organization walkthroughs.
Maintain the Integrated Inventory, reconcile it against vulnerability scan coverage, and coordinate responses to customer and agency security inquiries.

Requirements

At least six years of direct, hands-on experience developing and maintaining compliance programs, with a minimum of three years of direct FedRAMP experience at Moderate/High (Class B/D) levels.
Prior experience as an Information Systems Security Officer or equivalent role for a FedRAMP or FISMA system is strongly preferred.
Working knowledge of NIST SP 800-53, FedRAMP Certification Package documentation, and the Third Party Assessment Organization assessment process.
Familiarity with complementary frameworks such as NIST SP 800-171, CMMC, SOC 2, and ISO 27001; knowledge of U.S. export controls including ITAR and EAR.
Hands-on experience with GRC platforms such as Paramify or Vanta and vulnerability scanning tools such as Nessus.
Strong ability to plan and execute work within tight deadlines, review technical documentation, and communicate effectively across cross-functional teams.
U.S. person status is required (ITAR, 22 CFR 120.62) and you must reside in the United States.

What makes this role worth considering

This position offers the opportunity to build and shape a compliance program for a growing, venture-backed company recognized as the 57th fastest-growing company in North America. You will work independently in a role that values not just maintaining compliance, but establishing strong security practices from the ground up across a rapidly evolving GovCloud environment.