Product GRC Subject Matter Expert, (V4G)

Vanta for Government (V4G) is how we bring that mission to the public sector. As federal compliance undergoes its biggest shift in a decade — FedRAMP 20x, machine-readable authorization, OSCAL — we're building the platform that turns federal frameworks into automated, continuously monitored product experiences. The GRC Subject Matter Experts on this team are the people who make that possible. As Vanta's GRC Subject Matter Expert for V4G, you'll own federal compliance content used by every customer pursuing or maintaining federal authorization on our platform.

Responsibilities

Build and own federal compliance frameworks — Lead the creation, enhancement, and lifecycle management of controls, evidence requirements, and implementation guidance for FedRAMP (Low/Moderate/High), NIST SP 800-53, NIST SP 800-171, CMMC, DFARS, and StateRAMP; Interpret controls at the mechanics level — Work fluently with 800-53A assessment procedures and 800-53B baselines; Author automated tests and continuous monitoring — Translate controls and infrastructure context into spec-level automated tests and detectors; Lead V4G's machine-readable future — Shape how Vanta's federal content is architected for OSCAL and FedRAMP 20x; Design crosswalks and mappings — Maintain bidirectional crosswalks across federal frameworks; Act as a product advisor across discovery and design — Partner with the V4G PM and Design on feature discovery, review UI/UX, and author PRDs and acceptance criteria; Enable AI-assisted compliance — Partner with Engineering/ML to design LLM-powered guidance and automation for federal workflows; Synthesize feedback loops — Analyze input from customers, agencies, 3PAOs, and internal teams to identify content gaps and ship iterative updates; Raise the bar — Mentor and calibrate other SMEs, set content quality standards, and set framework strategy.

Requirements

8–10+ years in GRC and/or Information Security with hands-on federal compliance work: building or maintaining FedRAMP programs on the CSP side, authoring SSPs and supporting artifacts, and running continuous monitoring; Demonstrated fluency with the NIST 800-53/FedRAMP relationship, 800-53A/B, organization-defined parameters, control inheritance vs. non-applicability, customer responsibility matrices, PPSM, and STIG/CIS benchmarks; Working familiarity with OSCAL or other machine-readable compliance approaches and an informed point of view on where federal authorization is heading; Ability to turn a control into a functional test with defined pass and failure conditions, evidence sufficiency criteria, and coverage across relevant system components; Ability to translate requirements into productizable capabilities usable by organizations of every size; comfort with experimentation and data-driven prioritization; Active, current use of AI in GRC work: AI pair-programming tools to accelerate specs, mappings, and test logic; lightweight automations across Sheets/Airtable, APIs, and webhooks; AI-augmented workflows with measured outcomes; and safe-use patterns for prompts and agents; Precise control wording, mapping accuracy, and evidence specificity; comfortable in spreadsheets and large datasets; Excellent written and verbal skills; effective with engineers, designers, GTM teams, agencies, 3PAOs, and customers; Operates autonomously at Lead level, setting direction rather than awaiting it; Open to using AI to amplify skills and strengthen work, demonstrating curiosity, willingness to learn, and sound judgment in applying AI responsibly.

Nice to have

DoD impact-level (IL4/IL5) or CMMC experience; StateRAMP; CNSSI 1253/ICD 503; GovCloud or IL-environment architecture experience; prior product/content roles at a GRC platform; Certifications preferred, not required: CISSP-ISSEP, CISA, FedRAMP 3PAO assessor credentials (CCP/CCA), CISM, or equivalent experience.

Benefits

Industry-competitive salary and equity; Comprehensive medical, dental, and vision coverage, with 100% of employee-only benefit premiums covered for most medical plans; 16 weeks paid Parental Leave for all new parents; Health and wellness stipend; Remote workspace, internet, and cellphone stipend; Commuter benefits for team members who report to the SF and NYC office; Family planning benefits; Matching 401(k) contribution with immediate vesting; Flexible PTO policy, plus 80 hours of Sick Time; 11 company-paid holidays; Virtual team building activities, lunch and learns, and other company-wide events; Offices in SF, NYC, London, Dublin, Tel Aviv, and Sydney.