Lead Product GRC Subject Matter Expert

Role Description

As Vanta's Lead GRC Subject Matter Expert for V4G, you'll own federal compliance content used by every customer pursuing or maintaining federal authorization on our platform. This is an interpretation-and-authoring role, not a compliance program administration role:

• Interpret underlying control requirements and identify where FedRAMP modifies or constrains the NIST framework.
• Translate those interpretations into precise, technically testable guidance that engineering can build and customers can act on.
• Calibrate depth, precision, and universality in the content you write, which ships as product.

You'll join Vanta's Security organization, which directly influences product development and facilitates the creation of automated GRC solutions for customers.

What you’ll do as a V4G GRC SME at Vanta:

• Build and own federal compliance frameworks:
  • Lead the creation, enhancement, and lifecycle management of controls, evidence requirements, and implementation guidance for FedRAMP (Low/Moderate/High), NIST SP 800-53, NIST SP 800-171, CMMC, DFARS, and StateRAMP.
  • Author clear control rationales, acceptance criteria, and customer-facing guidance shipped as out-of-the-box product content.
• Interpret controls at the mechanics level:
  • Work fluently with 800-53A assessment procedures and 800-53B baselines.
  • Resolve organization-defined parameters and FedRAMP's constraints on them.
  • Decompose controls into distinct technical obligations.
  • Correctly resolve inherited, shared, and customer-owned responsibilities within a customer responsibility matrix.
  • Anchor evidence expectations in authoritative artifacts (PPSM, STIG, and CIS hardening standards).
• Author automated tests & continuous monitoring:
  • Translate controls and infrastructure context (AWS GovCloud, Azure Government, GCP, SaaS, endpoints, CI/CD) into spec-level automated tests and detectors.
  • Define test logic, data sources, edge cases, and failure conditions.
  • Pair with Engineering to implement and maintain detectors with versioned framework mappings.
• Lead V4G's machine-readable future:
  • Shape how Vanta's federal content is architected for OSCAL and FedRAMP 20x.
• Design crosswalks and mappings:
  • Maintain bidirectional crosswalks across federal frameworks with canonical control IDs, mapping confidence, and traceability to source authority.
• Act as a product advisor across discovery & design:
  • Partner with the V4G PM and Design on feature discovery.
  • Review UI/UX for control, evidence, and authorization workflows.
  • Author PRDs and acceptance criteria grounded in agency, auditor, and 3PAO needs.
• Enable AI-assisted compliance:
  • Partner with Engineering/ML to design LLM-powered guidance and automation for federal workflows.
  • Translate SME knowledge into machine-readable specs and define gold-standard evaluation sets.
• Synthesize feedback loops:
  • Analyze input from customers, agencies, 3PAOs, and internal teams to identify content gaps and ship iterative updates quickly and safely.
• Raise the bar:
  • Mentor and calibrate other SMEs, set content quality standards for the federal portfolio, and set framework strategy that others execute against.

Qualifications

• 8–10+ years in GRC and/or Information Security with hands-on federal compliance work.
• Demonstrated fluency with the NIST 800-53/FedRAMP relationship, 800-53A/B, organization-defined parameters, control inheritance vs. non-applicability.
• Working familiarity with OSCAL or other machine-readable compliance approaches.
• Ability to turn a control into a functional test with defined pass and failure conditions.
• Ability to translate requirements into productizable capabilities.
• Active, current use of AI in GRC work.
• Precise control wording, mapping accuracy, and evidence specificity.
• Excellent written and verbal skills; effective with engineers, designers, GTM teams, agencies, 3PAOs, and customers.
• Operates autonomously at Lead level, setting direction rather than awaiting it.

Requirements

• DoD impact-level (IL4/IL5) or CMMC experience is a strong plus.
• StateRAMP, CNSSI 1253/ICD 503, GovCloud or IL-environment architecture experience is nice-to-have.
• One or more of: CISSP-ISSEP, CISA, FedRAMP 3PAO assessor credentials (CCP/CCA), CISM, or equivalent experience preferred.

Benefits

• Industry-competitive salary and equity.
• Comprehensive medical, dental, and vision coverage, with 100% of employee-only benefit premiums covered for most medical plans.
• 16 weeks paid Parental Leave for all new parents.
• Health & wellness stipend.
• Remote workspace, internet, and cellphone stipend.
• Commuter benefits for team members who report to the SF and NYC office.
• Family planning benefits.
• Matching 401(k) contribution with immediate vesting.
• Flexible PTO policy, plus 80 hours of Sick Time.
• 11 company-paid holidays.
• Virtual team building activities, lunch and learns, and other company-wide events!
• Offices in SF, NYC, London, Dublin, Tel Aviv, and Sydney.