Product GRC Subject Matter Expert, (V4G)

Vanta for Government (V4G) is how we bring that mission to the public sector. As federal compliance undergoes its biggest shift in a decade — FedRAMP 20x, machine-readable authorization, OSCAL — we're building the platform that turns federal frameworks into automated, continuously monitored product experiences. The GRC Subject Matter Experts on this team are the people who make that possible.

As Vanta's GRC Subject Matter Expert for V4G, you'll own federal compliance content used by every customer pursuing or maintaining federal authorization on our platform. This is an interpretation-and-authoring role, not a compliance program administration role: your job is to interpret underlying control requirements, identify where FedRAMP modifies or constrains the NIST framework, and translate those interpretations into precise, technically testable guidance that engineering can build and customers can act on. The content you write ships as product — a five-person startup and a Fortune 100 CSP both receive it — so calibrating depth, precision, and universality is the core craft.

You'll join Vanta's Security organization, which directly influences product development, facilitates the creation of automated GRC solutions for customers, and provides expert advisory services across the company.

What you’ll do as a V4G GRC SME at Vanta:

• Build and own federal compliance frameworks — Lead the creation, enhancement, and lifecycle management of controls, evidence requirements, and implementation guidance for FedRAMP (Low/Moderate/High), NIST SP 800-53, NIST SP 800-171, CMMC, DFARS, and StateRAMP. Author clear control rationales, acceptance criteria, and customer-facing guidance shipped as out-of-the-box product content.

• Interpret controls at the mechanics level — Work fluently with 800-53A assessment procedures and 800-53B baselines; resolve organization-defined parameters and FedRAMP's constraints on them; decompose controls into distinct technical obligations; correctly resolve inherited, shared, and customer-owned responsibilities within a customer responsibility matrix; and anchor evidence expectations in authoritative artifacts (PPSM, STIG and CIS hardening standards and their scan outputs across operating systems, databases, network devices, and endpoints).

• Author automated tests & continuous monitoring — Translate controls and infrastructure context (AWS GovCloud, Azure Government, GCP, SaaS, endpoints, CI/CD) into spec-level automated tests and detectors. Define test logic, data sources, edge cases, and — critically — failure conditions: how unapproved items, exceptions, missing data, and unevaluated resources affect a result. Pair with Engineering to implement and maintain detectors with versioned framework mappings.

• Lead V4G's machine-readable future — Shape how Vanta's federal content is architected for OSCAL and FedRAMP 20x: machine-readable SSPs, config-as-compliance, and continuous authorization workflows.

• Design crosswalks and mappings — Maintain bidirectional crosswalks across federal frameworks (800-53 ↔ 800-171 ↔ CMMC ↔ StateRAMP) with canonical control IDs, mapping confidence, and traceability to source authority.

• Act as a product advisor across discovery & design — Partner with the V4G PM and Design on feature discovery, review UI/UX for control, evidence, and authorization workflows, and author PRDs and acceptance criteria grounded in agency, auditor, and 3PAO needs.

• Enable AI-assisted compliance — Partner with Engineering/ML to design LLM-powered guidance and automation for federal workflows. Translate SME knowledge into machine-readable specs, define gold-standard evaluation sets, and implement quality and safety guardrails.

• Synthesize feedback loops — Analyze input from customers, agencies, 3PAOs, and internal teams to identify content gaps and ship iterative updates quickly and safely.

• Raise the bar — Mentor and calibrate other SMEs, set content quality standards for the federal portfolio, and set framework strategy that others execute against.

How to be successful in this role:

• Experience — 8–10+ years in GRC and/or Information Security with hands-on federal compliance work: building or maintaining FedRAMP programs on the CSP side, authoring SSPs and supporting artifacts, and running continuous monitoring. DoD impact-level (IL4/IL5) or CMMC experience is a strong plus. Note: this is a builder role — candidates whose federal experience is primarily assessment (3PAO) or compliance program coordination will find the day-to-day is materially different from that work.

• Federal interpretation depth — Demonstrated fluency with the NIST 800-53/FedRAMP relationship, 800-53A/B, organization-defined parameters, control inheritance vs. non-applicability, customer responsibility matrices, PPSM, and STIG/CIS benchmarks.

• OSCAL & FedRAMP 20x — Working familiarity with OSCAL or other machine-readable compliance approaches, and an informed point of view on where federal authorization is heading.

• Test-design rigor — Ability to turn a control into a functional test with defined pass and failure conditions, evidence sufficiency criteria, and coverage across relevant system components.

• Product mindset — Ability to translate requirements into productizable capabilities usable by organizations of every size; comfort with experimentation and data-driven prioritization.

• Technical & automation (AI-augmented) — Active, current use of AI in GRC work: AI pair-programming tools to accelerate specs, mappings, and test logic; lightweight automations across Sheets/Airtable, APIs, and webhooks; AI-augmented workflows (LLM-assisted control guidance, cross-framework mapping, evidence triage) with measured outcomes; and safe-use patterns for prompts and agents.

• Analytical & detail-oriented — Precise control wording, mapping accuracy, and evidence specificity; comfortable in spreadsheets and large datasets.

• Communication & collaboration — Excellent written and verbal skills; effective with engineers, designers, GTM teams, agencies, 3PAOs, and customers.

• Self-motivated and independent — Operates autonomously at Lead level, setting direction rather than awaiting it.

• Nice-to-have — StateRAMP, CNSSI 1253/ICD 503, GovCloud or IL-environment architecture experience, or prior product/content roles at a GRC platform.

• Certifications (preferred, not required) — One or more of: CISSP-ISSEP, CISA, FedRAMP 3PAO assessor credentials (CCP/CCA), CISM, or equivalent experience.

• Open to using AI to amplify their skills and strengthen their work - demonstrating curiosity, a willingness to learn, and sound judgment in applying AI responsibly to improve efficiency and impact.

What you can expect as a Vanta’n:

• Industry-competitive salary and equity

• Health & wellness stipend

• Remote workspace, internet, and cellphone stipend

• Family planning benefits

• Matching 401(k) contribution with immediate vesting

• 11 company-paid holidays

#LI-remote