Governance, Risk & Compliance (GRC) Analyst

About the Role

Gallatin is looking for a GRC Analyst to build and run the security compliance program that lets our AI platforms operate inside the Department of Defense. You'll own the path from "great product" to "authorized to operate": driving Risk Management Framework (RMF) packages, maintaining our NIST SP 800-171 and CMMC posture, and making sure the data our customers entrust to us is governed with the rigor the mission demands.

This is a hands-on, high-ownership role for someone who treats compliance as an engineering problem, not a paperwork exercise. You'll sit between our engineering teams, our customers' ISSMs and authorizing officials, and our leadership, translating control requirements into implementable work and translating our systems into evidence assessors trust.

(Note: This position requires Active Secret clearance required; Top Secret / SCI eligible preferred)

What You'll Do

Authorization & Accreditation

• Drive RMF authorization packages for Gallatin products deployed across DoD environments, from system categorization and control selection through assessment and ATO.
• Own the System Security Plan (SSP), Plans of Action & Milestones (POA&Ms), and supporting artifacts, keeping them current as systems and deployments change.
• Serve as Gallatin's day-to-day counterpart to customer ISSMs, ISSOs, and assessors, answering questions, closing findings, and keeping authorizations on schedule.
• Coordinate data sharing agreements and interconnection documentation with government partners and adjacent programs.

Compliance Program Management

• Build and maintain Gallatin's compliance posture against NIST SP 800-171, CMMC Level 2, and NIST SP 800-53, with an eye toward FedRAMP and DoD Impact Level requirements (IL5/IL6).
• Run continuous monitoring: control testing, evidence collection, vulnerability and scan-result tracking, and remediation follow-through with engineering.
• Write and maintain security policies, procedures, and standards that reflect how we actually operate.
• Prepare for and lead internal audits and third-party assessments.

Fedramp & Cloud Authorization

• Lead Gallatin's FedRAMP readiness and authorization effort, from readiness assessment and boundary definition through agency sponsorship and authorization.
• Map our cloud architecture to the FedRAMP Moderate and High baselines and to DoD Cloud Computing SRG Impact Levels (IL4/IL5), identifying gaps and driving remediation with Engineering.
• Develop and maintain the FedRAMP package, including the SSP and its appendices, control implementation summaries, and the continuous monitoring plan.
• Coordinate with Third Party Assessment Organizations (3PAOs) and agency sponsors through assessment.
• Track FedRAMP program changes (including FedRAMP 20x and Rev. 5 baseline updates) and advise leadership on the fastest credible path to authorization.

Risk Management

• Maintain Gallatin's risk register, identifying, assessing, and tracking security and compliance risks across our products, infrastructure, and vendors.
• Evaluate third-party and supply chain risk for the tools, services, and partners we bring into our environments.
• Brief leadership on risk posture, open findings, and the tradeoffs behind remediation priorities.

Enablement & Automation

• Partner with Engineering and SRE to embed security controls into infrastructure-as-code, CI/CD, and deployment workflows so compliance is built in, not bolted on.
• Use modern tooling and AI to automate evidence collection and documentation, increasing the speed at which we can move through authorization.
• Support growth and proposals with security questionnaires, compliance responses, and capability statements.

What We’re Looking for

• Active Secret clearance, with the ability to obtain and maintain Top Secret / SCI.
• 3+ years of experience in GRC, cybersecurity compliance, or information assurance, ideally supporting DoD or federal systems.
• Direct experience supporting software authorizations at IL4/IL5/IL6
• Hands-on experience with the DoD RMF process (DoDI 8510.01) and authoring SSPs, POA&Ms, and control implementation statements.
• Working knowledge of NIST SP 800-53, NIST SP 800-171, CMMC, and CUI handling requirements (DoDI 5200.48).
• Working knowledge of the FedRAMP authorization process, baselines, and package requirements, and of the DoD Cloud Computing SRG and Impact Levels.
• A track record of working directly with government stakeholders (ISSMs, AOs, or assessors) and moving packages to approval.
• Ability to work cross-functionally with engineers, understanding cloud architecture well enough to assess and document controls accurately.
• Familiarity with eMASS, GRC platforms, and cloud security tooling (AWS GovCloud, Azure Government, or similar).
• Clear, precise writing and the judgment to know when a control is genuinely met and when it is not.
• Willingness to travel 10-25% to customer and government sites.

Bonus Points

• Security certifications such as CISSP, CISM, CAP/CGRC, Security+, or CMMC Certified Professional/Assessor.
• Experience taking an AI/ML or SaaS product through a DoD authorization or FedRAMP process.
• Direct experience supporting FedRAMP authorizations, either at a cloud service provider or a 3PAO.
• Experience in a startup or early-stage environment.
• Military or government background in cybersecurity, information assurance, or logistics.
• Experience with policy-as-code or compliance automation tooling.

Mission and Identity

We are building the system that enables faster, smarter logistics decisions in contested environments, and we're doing it with a team of seasoned entrepreneurs, operators, and technologists who have built and scaled solutions in this space before. We hold ourselves to an extremely high standard. We value clear thinking, direct communication, and the kind of ownership that doesn't stop until something actually works.

• Our mission is to create decision advantage when the stakes are the highest.
• If we succeed, the system doesn't just run; it gets smarter.
• We're not building AI for its own sake.
• We're building it because faster, smarter decisions in the most demanding environments on earth can't wait.
• If you want to work somewhere the stakes are real and the mission is urgent - you'll fit in here.

Compensation

Gallatin offers competitive compensation commensurate with experience. Actual compensation may vary based on experience, skills, and location. In addition to base salary, we offer a generous equity grant, full healthcare coverage, 401k, unlimited PTO, and the perks of working in a high-caliber, mission-driven environment.

This position may require the ability to obtain and maintain a U.S. government security clearance. The successful candidate must be able to work in a classified environment when necessary.

We comply with the United States Department of Labor's Pay Transparency provision

Note: Due to the nature of certain government contracts held by this organization, U.S. citizenship is a requirement for all positions at Gallatin. Proof of citizenship will be required prior to employment if selected.