Senior Compliance Analyst - Cloud Security

Knox runs the largest Federal & DoW managed cloud, building and operating secure cloud and AI environments that support the U.S. government's most critical missions. Knox is seeking a Senior Compliance Analyst with strong technical and regulatory expertise to help ensure Knox and its customers continuously meet federal and commercial compliance requirements. This is not a point-in-time audit support role. This position is expected to operate as a technical compliance lead who can validate controls in cloud environments, track remediation and POA&M performance, enforce compliance SLAs, support audits and assessments, and provide clear risk visibility to internal leadership and customers.

Responsibilities

Own continuous compliance oversight for Knox and assigned customer environments across FedRAMP, FISMA, NIST 800-53, IL4, IL5, CMMC, SOC 2, StateRamp, GovRAMP, and related frameworks; Track and enforce compliance obligations, remediation deadlines, POA&M milestones, vulnerability remediation timelines, and continuous monitoring requirements; Review and validate technical control implementation across AWS, Azure, and GCP environments, including logging, monitoring, IAM, incident response, vulnerability management, endpoint security, network segmentation, and change management; Partner with Security Operations, Compliance, DevOps, Engineering, and customer teams to ensure required controls are implemented and operating effectively; Support FedRAMP authorization and ongoing assessment activities, including SSP updates, evidence collection, ConMon support, 3PAO coordination, audit preparation, and customer artifact reviews; Evaluate findings and weaknesses using both compliance requirements and operational risk, including exploitability, exposure, compensating controls, and customer responsibility boundaries; Maintain visibility into customer compliance posture and ensure customers meet shared-responsibility obligations and required service-level timelines; Manage all customer-facing compliance activities, including coordinating ConMon submissions, leading POA&M reviews, managing SCR/SCN with customers, and acting as primary liaison for agency communication; Prepare dashboards, metrics, and executive reporting for overdue findings, POA&Ms, control gaps, remediation status, audit readiness, and overall compliance posture; Escalate material compliance gaps, SLA misses, and recurring customer issues to Knox leadership with clear recommendations and risk context; Help improve Knox's compliance processes, templates, playbooks, and automation capabilities, leveraging compliance-as-code and KnoxAI

Requirements

7+ years of experience in cybersecurity compliance, GRC, cloud security, or related security assurance roles; Direct experience with FedRAMP and NIST SP 800-53 in cloud or SaaS environments; Strong working knowledge of FISMA, SOC 2, StateRamp, GovRAMP, and at least one of the following: IL4, IL5, CMMC, NIST 800-171; Experience supporting audits, assessments, or authorization activities in regulated cloud environments; Strong understanding of cloud platforms such as AWS, Azure, and/or GCP and how security controls are implemented within them; Experience partnering with technical teams such as DevOps, SOC, SRE, Engineering, or IT Operations to validate control implementation and drive remediation; Ability to manage multiple customers, priorities, deadlines, and dependencies in a fast-paced environment; Strong written and verbal communication skills, including the ability to explain compliance requirements, technical findings, and risk decisions clearly to both technical and non-technical stakeholders; U.S. citizenship required, dual citizenship not permitted

Nice to have

Experience with FedRAMP High and/or DoD IL4 / IL5 environments; Experience working with continuous monitoring, POA&M governance, vulnerability remediation tracking, and customer audit readiness; Familiarity with cloud/security tooling such as CSPM, SIEM, EDR/XDR, ticketing/GRC platforms, and evidence automation workflows; Experience with shared responsibility models in managed cloud or regulated SaaS environments; Certifications such as CISSP, CISA, CAP, Security+, CCSP, or cloud security certifications; Experience in a high-growth cloud company, managed services provider, or regulated SaaS provider

Benefits

Medical; Dental; Vision; Life & Disability; Unlimited PTO; Employee funded 401k plan; Variable annual bonus; Equity; Veteran hiring support