Governance, Risk & Compliance (GRC) Analyst

The role

The GRC Analyst will build and run the security compliance program to allow AI platforms to operate inside the Department of Defense. This role involves driving RMF packages, maintaining NIST and CMMC posture, and translating control requirements for engineering teams and government stakeholders.

What you will do

• Drive RMF authorization packages for Gallatin products deployed across DoD environments
• Own the System Security Plan (SSP), Plans of Action & Milestones (POA&Ms), and supporting artifacts
• Serve as the day-to-day counterpart to customer ISSMs, ISSOs, and assessors
• Coordinate data sharing agreements and interconnection documentation with government partners
• Build and maintain compliance posture against NIST SP 800-171, CMMC Level 2, and NIST SP 800-53
• Run continuous monitoring including control testing, evidence collection, and vulnerability tracking
• Write and maintain security policies, procedures, and standards
• Prepare for and lead internal audits and third-party assessments
• Lead FedRAMP readiness and authorization efforts
• Maintain the risk register and evaluate third-party and supply chain risk

Required qualifications

• Active Secret clearance
• Ability to obtain and maintain Top Secret / SCI
• 3+ years of experience in GRC, cybersecurity compliance, or information assurance
• Direct experience supporting software authorizations at IL4/IL5/IL6
• Hands-on experience with the DoD RMF process (DoDI 8510.01)
• Authoring SSPs, POA&Ms, and control implementation statements
• Working knowledge of NIST SP 800-53, NIST SP 800-171, CMMC, and CUI handling requirements (DoDI 5200.48)
• Working knowledge of the FedRAMP authorization process, baselines, and package requirements
• Working knowledge of the DoD Cloud Computing SRG and Impact Levels
• Track record of working directly with government stakeholders (ISSMs, AOs, or assessors)
• Ability to work cross-functionally with engineers
• Familiarity with eMASS, GRC platforms, and cloud security tooling (AWS GovCloud, Azure Government, or similar)

Nice to have

• Security certifications such as CISSP, CISM, CAP/CGRC, Security+, or CMMC Certified Professional/Assessor
• Experience taking an AI/ML or SaaS product through a DoD authorization or FedRAMP process
• Direct experience supporting FedRAMP authorizations, either at a cloud service provider or a 3PAO
• Experience in a startup or early-stage environment
• Military or government background in cybersecurity, information assurance, or logistics
• Experience with policy-as-code or compliance automation tooling

Benefits

• generous equity grant
• full healthcare coverage
• 401k
• unlimited PTO
• perks of working in a high-caliber, mission-driven environment

Before you apply

• Active Secret clearance required
• Ability to obtain and maintain Top Secret / SCI
• U.S. citizenship is a requirement for all positions
• Proof of citizenship will be required prior to employment
• Must be able to work in a classified environment when necessary

About the company

Gallatin is rebuilding logistics infrastructure for the national security missions of the United States and allied partners. They build AI systems that determine how logistics decisions are made.