Governance, Risk & Compliance (GRC) Analyst

ABOUT GALLATIN

At Gallatin, we are rebuilding logistics infrastructure for the national security missions of the United States and allied partners. We build AI systems that determine how logistics decisions are made, not just how they're executed. From factory to foxhole, we operate at the layer where data becomes decisions, and decisions make the advantage.

ABOUT THE ROLE

Gallatin is looking for a GRC Analyst to build and run the security compliance program that lets our AI platforms operate inside the Department of Defense. You'll own the path from "great product" to "authorized to operate": driving Risk Management Framework (RMF) packages, maintaining our NIST SP 800-171 and CMMC posture, and making sure the data our customers entrust to us is governed with the rigor the mission demands.

This is a hands-on, high-ownership role for someone who treats compliance as an engineering problem, not a paperwork exercise. You'll sit between our engineering teams, our customers' ISSMs and authorizing officials, and our leadership, translating control requirements into implementable work and translating our systems into evidence assessors trust.

(Note: This position requires Active Secret clearance required; Top Secret / SCI eligible preferred)

WHAT YOU'LL DO

AUTHORIZATION & ACCREDITATION

- Drive RMF authorization packages for Gallatin products deployed across DoD environments, from system categorization and control selection through assessment and ATO.

- Own the System Security Plan (SSP), Plans of Action & Milestones (POA&Ms), and supporting artifacts, keeping them current as systems and deployments change.

- Serve as Gallatin's day-to-day counterpart to customer ISSMs, ISSOs, and assessors, answering questions, closing findings, and keeping authorizations on schedule.

- Coordinate data sharing agreements and interconnection documentation with government partners and adjacent programs.

COMPLIANCE PROGRAM MANAGEMENT

- Build and maintain Gallatin's compliance posture against NIST SP 800-171, CMMC Level 2, and NIST SP 800-53, with an eye toward FedRAMP and DoD Impact Level requirements (IL5/IL6).

- Run continuous monitoring: control testing, evidence collection, vulnerability and scan-result tracking, and remediation follow-through with engineering.

- Write and maintain security policies, procedures, and standards that reflect how we actually operate.

- Prepare for and lead internal audits and third-party assessments.

FEDRAMP & CLOUD AUTHORIZATION

- Lead Gallatin's FedRAMP readiness and authorization effort, from readiness assessment and boundary definition through agency sponsorship and authorization.

- Map our cloud architecture to the FedRAMP Moderate and High baselines and to DoD Cloud Computing SRG Impact Levels (IL4/IL5), identifying gaps and driving remediation with Engineering.

- Develop and maintain the FedRAMP package, including the SSP and its appendices, control implementation summaries, and the continuous monitoring plan.

- Coordinate with Third Party Assessment Organizations (3PAOs) and agency sponsors through assessment.

- Track FedRAMP program changes (including FedRAMP 20x and Rev. 5 baseline updates) and advise leadership on the fastest credible path to authorization.

RISK MANAGEMENT

- Maintain Gallatin's risk register, identifying, assessing, and tracking security and compliance risks across our products, infrastructure, and vendors.

- Evaluate third-party and supply chain risk for the tools, services, and partners we bring into our environments.

- Brief leadership on risk posture, open findings, and the tradeoffs behind remediation priorities.

ENABLEMENT & AUTOMATION

- Partner with Engineering and SRE to embed security controls into infrastructure-as-code, CI/CD, and deployment workflows so compliance is built in, not bolted on.

- Use modern tooling and AI to automate evidence collection and documentation, increasing the speed at which we can mo