Compliance Operations Lead

About GovSignals

We are shaping the future of government contracting with breakthrough AIdriven solutions. We are disrupting a multibillion dollar industry and enabling privatesector technologies to secure government contracts faster than ever, strengthening national security and driving economic growth.

GovSignals has built the most advanced governmentcontracting AI platform available. From small businesses to Fortune 500 enterprises, our platform multiplies the opportunities contractors can pursue and empowers them to deliver fully compliant, winning proposals in hours instead of months. As one of the largest aggregators of U.S. government data, we set trends rather than follow them.

The Role

In government contracting, compliance is a moat. FedRAMP High, IL5, CMMC Level 2, SOC 2-these are the gates that decide which platforms get to serve the DoD, the Intelligence Community, and the largest agencies in the federal government. We need a Compliance Operations Lead who treats that gate as offense, not paperwork.

This is not a role where you write policy docs, file them in a binder, and chase tickets through a GRC tool. You will own GovSignals' entire security and compliance posture endtoend-architecting the program, automating the evidence, partnering directly with engineering, and standing in front of customers and auditors as the face of our trust story. You'll move at product speed. When a control fails or an auditor flags an exception, you fix it because it's yours.

Compliance at GovSignals is a product. It ships, it scales, and it has to keep up with an aggressive engineering cadence. We want someone who automates evidence collection in CI/CD instead of chasing screenshots. Someone who treats every customer security review as a sales asset, not a tax. Someone who has done this before at a highgrowth defense or dualuse startup-and knows the difference between checking the box and building something defensible.

This role reports directly into the founding team. You will have full company support to hit our compliance milestones, and you'll be expected to prioritize compliance as a means to an end-shipping product and unlocking customers.
Key Responsibilities

Compliance Program Ownership

• Build and run the master compliance program covering FedRAMP High, IL5, CMMC Level 2, SOC 2, and adjacent publicsector frameworks.
• Drive the FedRAMP High ATO roadmap endtoend, including 3PAO coordination, agency sponsorship navigation, and continuous monitoring once authorized
• Maintain a forwardlooking compliance roadmap that anticipates new frameworks, customer requirements, and regulatory changes-we shouldn't be reacting; we should be ahead

Evidence Automation & Audit Readiness

• Own evidence management endtoend: gather, organize, and automate collection so we are auditready every day, not the week before fieldwork
• Stand up automated policy checks, control evidence capture, and continuous monitoring tooling-if it can be scripted, it should be
• Lead quarterly and annual security documentation cycles, coordinate penetration tests and redteam engagements, and track remediation through to closure

Customer Trust, BD & Sales Enablement

• Be the primary voice on enterprise security questionnaires and customer trust calls-we win deals when buyers trust our posture
• Partner directly with Sales as a frontline credibility asset-join customer pitches and discovery calls, brief prospects on our compliance roadmap, and close the trust gap that often decides sevenfigure deals
• Help represent GovSignals at industry conferences, customer events, and federal/defense forums-build relationships with security leaders at target accounts and bring back signal that shapes our roadmap
• Translate complex compliance posture into clear narratives for both technical security teams and nontechnical executives
• Build and maintain a customerfacing trust center, security collateral, and reusable response library that compresses sales cycles

Engineering Partnership

• Embed securebydesign practices alongside engineering-policy checks in CI/CD, infrastructureascode guardrails, hardened deployment pipelines
• Identify smart, outsideof-thebox solutions to compliance roadblocks. Help guide company roadmaps to scope and prepare for compliance changes.
• Monitor the evolving threat landscape and propose proactive hardening measures-you don't wait for an incident to drive change

Who You Are

You've taken a startup through a real highimpact authorization-FedRAMP High, IL5, or equivalent. You know what it takes to build a compliance program from a blank page, not just optimize one someone else built.

You write policy and you read code. You can sit with an auditor and a senior engineer in the same meeting and translate cleanly between them. You see compliance as a product surface, not a paperwork exercise-something that ships, scales, and gets better with every release.

You're fast, but not sloppy. You understand that one failed control or one botched questionnaire response can stall a sevenfigure deal, and you operate with that level of seriousness. You're not looking for a 9to5. You're looking for a mission-and the ownership stake to go with it.

Required Qualificaitons

• 3+ years leading compliance or security programs at a highgrowth technology or defense startup
• Demonstrated success achieving and maintaining FedRAMP High ATO or an equivalent highimpact authorization
• Deep working fluency with IL5, CMMC Level 2, SOC 2 Type II, NIST 800171, and the broader U.S. publicsector compliance landscape
• Proven ability to design and run automated evidence collection, policy management, and vulnerabilitytracking workflows-not just operate someone else's GRC tool
• Strong written and verbal communication skills for both technical and executive audiences; comfortable owning customer security reviews endtoend
• Experience coordinating redteam, penetrationtest, or bugbounty programs and translating findings into engineering action
• Comfort operating in a fastmoving, earlystage environment where priorities shift and you own the outcome

Bonus: Handson exposure to Kubernetes, Terraform, JAMF, and modern DevSecOps toolchains; prior experience supporting an IC or DoD customer base.

What This is Not

This is not a role for a compliance manager who needs a tenperson GRC team to function. If your job has been reviewing tickets in Drata or Vanta and emailing auditors back, this isn't the right fit. If you treat compliance as a paperwork function rather than a competitive weapon, this isn't the right fit. If "startup hours" sounds like a red flag rather than a rallying cry, this isn't the right fit.

We need someone who runs toward hard problems, automates relentlessly, and measures their impact in authorizations achieved and customer deals unblocked-not policies filed.

Compensation & Benefits

• Base Salary: 140,000 - 190,000
• Equity: Meaningful stake in a well-funded, fast-growing startup-we want you to win big when we win big
• Benefits : Medical, Vision, and Dental
• Unlimited PTO
• Direct access to the founding team and endtoend ownership from day one