Senior Compliance Analyst - FedRAMP

About CoLab

At CoLab, we help mechanical engineering teams bring life-changing products to market years sooner.

We build AI for engineers designing cars, medical devices, and jet engines. Products this complex aren't sketched and sent to production. Teams spend months on iterations, reviews, and tests, predicting how every part performs before anything is built. CoLab is where those reviews happen, and we capture the rationale behind every change. Other tools show what changed between versions. Only CoLab knows why. That's how our AI helps manufacturers like Bobcat, Triumph Motorcycles, and GE Appliances make better decisions, eliminate rework cycles, and get to market faster.

Proudly based in St. John’s, Newfoundland, CoLab started with one customer in 2018. Since then we’ve raised a $72M Series C, been named the 57th fastest growing company in North America by Deloitte (Fast 500™), signed multi-year AI partnerships with companies like Bombardier, and grown to a team of 250+.

About the Role

As a Senior Compliance Analyst specializing in FedRAMP, you will be the Information System Security Officer (ISSO) for CoLab’s GovCloud environment, which holds a FedRAMP Class D Certification. You will be responsible for the full lifecycle of our GovCloud compliance program, including the Certification Package, Ongoing Certification reporting, the significant change process, and our transition to updated FedRAMP requirements. This is a hands-on role that requires a high degree of organization. This role reports to the Director of Risk and Compliance, independent of the System Owner.

Our Ideal Candidate

You're a senior compliance professional with a background in security, risk, and regulatory frameworks and FedRAMP. You’ve led audits for complex certifications in the past. You can confidently navigate conversations with auditors, customers, and executives alike. You know how to manage multiple workstreams without losing sight of the details.

You’re not looking to just “maintain compliance.” You want to build something. You know what right looks like and aren’t afraid to roll up your sleeves to get there—whether that’s writing policy from scratch, configuring a GRC tool, or jumping on a customer call to walk through our controls.

This role requires U.S. person status (ITAR, 22 CFR 120.62) and residence in the United States.

Job Responsibilities:

- Serve as Information System Security Officer for the GovCloud system.

- Act as the main compliance point of contact for CoLab’s agency sponsor, the FedRAMP PMO and CoLab’s 3PAO.

- Develop and maintain the Certification Package Overview and Security Decision Record (formerly the System Security Plan, SSP) and its attachments in CoLab's GRC platform (Paramify).

- Maintain NIST SP 800-53 control mappings to the FedRAMP Class D baseline, working with control owners to document each control’s implementation.

- Run vulnerability reporting under FedRAMP's Vulnerability Detection and Response (VDR) and Vulnerability Evaluation and Reporting (VER) rules. This includes persistent reporting to agencies, a monthly human-readable summary, machine-readable (JSON) vulnerability history, PAIN-based remediation timelines and accepted-vulnerability tracking.

- Own the Significant Change Notification (SCN) process. Classify changes as routine, adaptive or transformative, run the Security Impact Analysis and Change Control Board (CCB) intake, file SCNs within FedRAMP deadlines and keep 12 months of SCN history.

- Lead CoLab's transition to new FedRAMP requirements: VDR/VER adoption (planned for December 2026), mandatory SCN rules (January 1, 2027) and the move from Rev5 to FedRAMP 20x. Track further changes to FedRAMP rules and guidance and prepare the team for them.

- Lead the monthly Ongoing Certification meeting with agency sponsor and coordinate the annual assessment.

- Prepare and schedule Third Party Assessment Organization (3PAO) walkthroughs with control owners.

- Participate in FedRAMP a