Senior Compliance Analyst - FedRAMP

Title: Senior Compliance Analyst - FedRAMP Location: United States, Remote

About CoLab

At CoLab, we help mechanical engineering teams bring life-changing products to market years sooner.

We build AI for engineers designing cars, medical devices, and jet engines. Products this complex aren't sketched and sent to production. Teams spend months on iterations, reviews, and tests, predicting how every part performs before anything is built. CoLab is where those reviews happen, and we capture the rationale behind every change. Other tools show what changed between versions. Only CoLab knows why. That's how our AI helps manufacturers like Bobcat, Triumph Motorcycles, and GE Appliances make better decisions, eliminate rework cycles, and get to market faster.

Proudly based in St. John’s, Newfoundland, CoLab started with one customer in 2018. Since then we’ve raised a $72M Series C, been named the 57th fastest growing company in North America by Deloitte (Fast 500™), signed multi-year AI partnerships with companies like Bombardier, and grown to a team of 250+.

About the Role

As a Senior Compliance Analyst specializing in FedRAMP, you will be the Information System Security Officer (ISSO) for CoLab’s GovCloud environment, which holds a FedRAMP Class D Certification. You will be responsible for the full lifecycle of our GovCloud compliance program, including the Certification Package, Ongoing Certification reporting, the significant change process, and our transition to updated FedRAMP requirements. This is a hands-on role that requires a high degree of organization. This role reports to the Director of Risk and Compliance, independent of the System Owner.

Our Ideal Candidate

You're a senior compliance professional with a background in security, risk, and regulatory frameworks and FedRAMP. You’ve led audits for complex certifications in the past. You can confidently navigate conversations with auditors, customers, and executives alike. You know how to manage multiple workstreams without losing sight of the details.

You’re not looking to just “maintain compliance.” You want to build something. You know what right looks like and aren’t afraid to roll up your sleeves to get there—whether that’s writing policy from scratch, configuring a GRC tool, or jumping on a customer call to walk through our controls.

This role requires U.S. person status (ITAR, 22 CFR 120.62) and residence in the United States.

Job Responsibilities:

• Serve as Information System Security Officer for the GovCloud system.
• Act as the main compliance point of contact for CoLab’s agency sponsor, the FedRAMP PMO and CoLab’s 3PAO.
• Develop and maintain the Certification Package Overview and Security Decision Record (formerly the System Security Plan, SSP) and its attachments in CoLab's GRC platform (Paramify).
• Maintain NIST SP 800-53 control mappings to the FedRAMP Class D baseline, working with control owners to document each control’s implementation.
• Run vulnerability reporting under FedRAMP's Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules. This includes persistent reporting to agencies, a monthly human-readable summary, machine-readable (JSON) vulnerability history, PAIN-based remediation timelines and accepted-vulnerability tracking.
• Own the Significant Change Notification (SCN) process. Classify changes as routine, adaptive or transformative, run the Security Impact Analysis and Change Control Board (CCB) intake, file SCNs within FedRAMP deadlines and keep 12 months of SCN history.
• Lead CoLab's transition to new FedRAMP requirements: VDR/VER adoption (planned for December 2026), mandatory SCN rules (January 1, 2027) and the move from Rev5 to FedRAMP 20x. Track further changes to FedRAMP rules and guidance and prepare the team for them.
• Lead the monthly Ongoing Certification meeting with agency sponsor and coordinate the annual assessment.
• Prepare and schedule Third Party Assessment Organization (3PAO) walkthroughs with control owners.
• Participate in FedRAMP assessments and audits. Prepare documentation, respond to assessor and agency inquiries, and collect control evidence.
• Own the Integrated Inventory (Appendix M), reconciling it against Nessus scan coverage and updating it whenever the boundary changes
• Review GovCloud feature eligibility requests with Product and Engineering for compliance impact.
• Coordinate responses to customer and agency security inquiries and questionnaires under tight timelines.
• Monitor compliance activities to ensure deadlines are met across FedRAMP and other frameworks.
• Create and maintain documentation that supports compliance requirements.
• Work with Security, Compliance, IT and Cloud to prioritize and complete operational tasks, including evidence collection and boundary and inventory updates.

Qualifications

• 6+ years of hands-on experience developing, implementing and maintaining compliance programs, including 3+ years of direct FedRAMP experience (Moderate/High, now Class B/D).
• Prior experience as an Information Systems Security Officer (or in a similar role) for a FedRAMP or FISMA system is strongly preferred.
• Working knowledge of NIST SP 800-53, FedRAMP Certification Package documentation and the 3PAO assessment process. Familiarity with the FedRAMP Consolidated Rules for 2026 (VDR, VER, SCN) and FedRAMP 20x is a strong plus.
• Familiarity with complementary frameworks, especially those that apply to customers handling Controlled Unclassified Information (CUI): NIST SP 800-171 and CMMC. Experience with SOC 2 and ISO 27001 frameworks is also an asset.
• Knowledge of U.S. export controls (ITAR and EAR).
• Experience with GRC platforms such as Paramify or Vanta, and with vulnerability scanning tools such as Nessus.
• Ability to plan and complete work within tight deadlines.
• Ability to review and interpret technical documentation, regulatory reference materials and compliance frameworks.
• Strong communication and interpersonal skills, and the ability to collaborate with cross-functional teams.
• Must be a U.S. person (ITAR, 22 CFR 120.62) and based in the United States. This role deals with highly sensitive information and requires an enhanced background check.

Extra Details

Compensation: This is a full-time, permanent position with a competitive compensation package that includes a stock options package.

Benefits: Extended health and benefits, unlimited paid vacation, and 401K matching

This role can be worked remotely from anywhere in the United States with occasional travel to our Canadian headquarters required.

Equity Note

Frequently cited statistics show that people who identify with historically marginalized groups are likely to apply to jobs only if they meet 100% of the qualifications. We encourage you to help us break that statistic and apply even if you don’t meet every single qualification—your potential is what matters most to us.