US Public Sector Compliance, Security GRC

Key responsibilities

• Run the recurring compliance cycles for our US government authorizations (continuous monitoring, POA&M, annual assessments, SSP updates, significant changes and incident notifications), starting with C4G on Palantir FedStart and the NIST SP 800-171 assessment with Schellman
• Co-own FedRAMP 20x work for Claude Enterprise, and help build new authorizations (first-party FedRAMP High, DoW impact levels, StateRAMP and TX-RAMP) with requirements and evidence work
• Support model authorizations in GovCloud and Vertex for every model launch, as the GRC member of the Inference and model delivery pod
• Translate government obligations into partner team requirements, for example vulnerability SLAs in our internal vulnerability reporting platform, and review the evidence
• Answer public sector customer and deal questions (what a boundary allows, CUI, IRS Publication 1075, CJIS, ITAR), and handle questionnaires and RFIs until they move to Customer Trust
• Map US government requirements onto the Common Control Framework with the Controls Assurance Lead and keep one source of truth for status
• Build with Claude: automate mapping, evidence collection and reporting, and verify machine-drafted language before it becomes the record

Minimum qualifications

• Several years in security compliance or IT audit with hands-on US government compliance for a cloud service (FedRAMP, DoD impact levels, CMMC or NIST SP 800-171, or StateRAMP), including the ongoing compliance cycle after authorization
• Working command of the NIST SP 800-53 Moderate baseline and the mechanics of authorization: boundary definition, control implementation statements, assessment, continuous monitoring, POA&M and significant change
• Experience writing requirements for engineering teams from a control baseline and reviewing the evidence that came back
• Working knowledge of how a GovCloud or Vertex style government region differs from commercial, and what changes when a model, feature or region is added to an authorized boundary
• Enough technical fluency to read a runbook, configuration or pipeline definition and judge whether it enforces the written control
• Clear writing, because implementation statements and status reports are what assessors, engineers and leadership work from
• Ability to get partner teams to prioritize and close compliance work without authority over them

Preferred qualifications

• Have taken a service through FedRAMP High or DoD IL4 or IL5, or supported a service on classified networks
• Have worked on a FedRAMP 20x pilot or built machine-readable evidence or reporting for an assessor
• Have applied LLMs to compliance work such as control mapping, evidence testing or continuous evidence collection
• Hold or are eligible for a US security clearance
• Experience with state and local requirements such as StateRAMP, TX-RAMP, IRS Publication 1075 or CJIS

You don't need to

• Have done everything on this list or worked every regime. The scarce combination is running a government authorization on its recurring cycle plus the judgment to tell whether a control actually works
• Write production code. The bar is fluency sufficient to read, query and challenge
• Hold every certification. CISSP, CISA, CGRC or similar are welcome and not required
• Have prior AI industry experience

Deadline to apply: None. Applications will be received on a rolling basis. The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role.

Annual Salary:

$255,000 - $270,000 USD

Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this.