Senior Federal Compliance Analyst

Get to Know Us Horizon3 is a fast-growing, remote cybersecurity company dedicated to the mission of enabling organizations to proactively find and fix and verify exploitable attack vectors before criminals exploit them. Our flagship product, the NodeZeroTM platform, delivers production-safe autonomous pentests and other key assessment operations that scale across the largest internal, external, cloud, and hybrid cloud environments. NodeZero has been adopted by organizations of all sizes, from small educational institutions to government agencies and Global 100 enterprises. It is used by ITOps/SecOps teams, consulting pentesters, and MSSPs and MSPs.  We are a fusion of former U.S. Special Operations cyber operators, startup engineers, and formerly frustrated cybersecurity practitioners. We're committed to helping solve our common security problems: ineffective security tools, false positives resulting in alert fatigue, blind spots, "checkbox” security culture, cybersecurity skills shortage, and the long lead time and expense of hiring outside consultants. Collectively, we are a team of learn it alls, committed to a culture of respect, collaboration, ownership, and results.   Summary/Overview We are seeking a Senior Federal Compliance Analyst to serve as the focal point for Horizon3’s Federal Compliance Program, focused on the security posture and compliance strategy, build-out, and continuous management of our DoW Impact Level 4 (IL4) and Impact Level 5 (IL5) offerings. In this role, you will bridge the gap between federal regulatory bodies, security teams, and engineering. You will be responsible for ensuring the regulatory compliance of our applications, products, services, and personnel, acting as the subject matter expert on DoW security requirements for our AWS-hosted environments. Essential Functions - IL4/IL5 Strategy & Execution: Lead the compliance assessments and build-out of our IL4 and IL5 authorizations, ensuring Horizon3 meets the stringent requirements of the DoW Cloud Computing Security Requirements Guide (CC SRG). - Framework Management: Maintain and evolve our compliance posture for FedRAMP High, NIST SP 800-53, and other relevant federal frameworks. - Engineering Advisory: Act as a GRC liaison to our development and engineering teams, translating complex DoW and federal compliance requirements into actionable technical specifications for cloud-native infrastructure. - Continuous Monitoring & Auditing: Oversee internal audits, risk assessments, and the continuous monitoring (ConMon) program. - External Audits & Liaison: Serve as a primary point of contact for external auditors (3PAOs), federal sponsors, and regulatory bodies to ensure that the company meets all necessary compliance requirements. - Vendor & Security Responses: Respond to external requests for Security Questionnaires, Due Diligence, and Vendor Risk Assessments regarding Horizon3’s federal security program. - Policy Development & Training: Develop and maintain GRC policies and procedures. Create and deliver compliance training to employees to foster a security-first culture across the organization. - Incident Response: Participate in incident response and investigations related to compliance issues or federal data. Competencies - The ideal candidate is a self-starter and has a "learn-it-all" type of mentality with a passion for security. - Strong knowledge of cybersecurity frameworks and regulations, specifically DoW CC SRG (IL4/IL5), FedRAMP High/Moderate, and NIST SP 800-53. - Excellent written and verbal communication skills, capable of explaining technical compliance risks to both technical engineers and non-technical stakeholders. - Experience writing and maintaining FedRAMP System Security Plans, Policies, Pr