Job description
At Vanta, our mission is to secure the internet and protect consumer data. We believe that security should be monitored and verified continuously, and we empower companies to practice better security and prove it with ease. Vanta has a kind and talented team, and while some have prior security experience, many have been successful at Vanta without it.
Vanta is growing quickly and we’re continually moving upmarket, dealing with sophisticated customers with complex security and compliance environments and needs. Our Security team uses our own Security and Privacy GRC experience to meet customer demand to help grow our market share as the industry leader in compliance and security.
As a Compliance Automation Engineer, GRC at Vanta, you will support FedRAMP Authorization efforts on the Vanta Security Team, working closely with cross-functional Engineering and Product teams. Your focus will be managing critical authorization audit readiness and continuous monitoring process, automating evidence collection wherever possible.
If this sounds like you, and you’re excited to use your Security and GRC experience to help grow and sell our product, we’d love to hear from you.
Visit our Vanta Engineering Blog to learn more about what our team is working on!
What you’ll do as a Compliance Automation Engineer, GRC at Vanta:
Design and develop automation solutions for evidence collection across infrastructure, endpoints, and SaaS platforms (e.g., AWS, GCP, GitHub, Okta).
Build and maintain scripts and APIs to interface with compliance tooling
Support recurring internal and external audits (FedRAMP, SOC 2, ISO 27001, HIPAA, etc.) by ensuring automated and reliable control monitoring
Automate control testing and reporting pipelines to reduce manual effort and improve accuracy
Support internal GRC platforms, dashboards, and metrics to communicate compliance posture and audit findings
Work with the compliance team to define technical control requirements and translate them into measurable, testable systems
Work with Engineering partners to embed compliance checks into CI/CD pipelines and infrastructure deployment workflows
Establish and manage the POAM and Continuous Monitoring processes and run monthly PMO meetings
Manage compliance deliverables for public sector stakeholders and manage ongoing updates
Leverage AI/ML tools to drive automation and improve efficiency and outcomes for audit and monitoring processes
Drive remediation for Security Team gaps and dependencies - this includes investigating and POCing solutions to replace existing tech where needed
Drive remediation of FedRMAP authorization gaps
Support policy and process implementation for business and engineering processes to support authorization
Support the implementation of technical controls within the security and engineering teams
Contribute to the development of machine readable reports for Product Team
Gather performance metrics and report KPIs to security team leaders
Become an expert on the Vanta public sector product offerings and provide regular feedback to product teams
Support the team responding to public sector security questionnaires
Partner to help improve existing and launch new security and compliance processes, programs, and policies where needed
Support audit readiness across Vanta’s compliance frameworks as needed
How to be successful in this role:
3+ years of experience in scripting, automation, or backend engineering roles with a focus on security, infrastructure, or compliance
Expertise with public sector security frameworks like FedRAMP and CMMC
Experience with other NIST frameworks like NIST CSF, 800-53, 800-171, RMF
Ability to write scripts and basic code to automate audit and evidence gathering processes
Proficiency in at least one or more common scripting languages like Python, Go, PowerShell, Bash, Ruby, or JavaScript,
Experience consuming and building RESTful APIs to integrate various security, IT, and GRC tools
Experience querying APIs, building command-line tools, and working with structured data (JSON, CSV, YAML, OSCAL)
Ability to query and manipulate data in various datastores to extract compliance-relevant information
Familiarity with Cloud Infrastructure, Version Control Systems, Risk Management, Vulnerabilities, and their related security processes
Experience in product and program management
Experience in building productive relationships and driving collaboration with both technical and non-technical teams
Knowledge of audit processes and evidence requirements for cybersecurity frameworks
Security compliance management experience within a SaaS environment preferred, but not required
Experience working with other security frameworks like SOC2 and ISO27001 preferred but not required
Security certifications (e.g. CISA, CISSP, CRISC) and/or formal education strongly preferred, but not required
What you can expect as a Vantan:
Industry-competitive compensation
100% covered medical, dental, and vision benefits with dependents coverage
16 weeks fully-paid parental Leave for all new parents
Health & wellness and remote workplace stipends
Family planning benefits through Carrot Fertility
401(k) matching
Flexible work hours and location
Open PTO policy
11 paid holidays in the US
Offices in SF, NYC, London, Dublin, and Sydney
To provide greater transparency to candidates, we share base pay ranges for all US-based job postings regardless of state. We set standard base pay ranges for all roles based on function, level, and country location, benchmarked against similar-stage growth companies. Final offer amounts are determined by multiple factors and may vary based on candidate location, skills, depth of work experience, and relevant licenses/credentials.
#LI-remote
At Vanta, we are committed to hiring diverse talent of different backgrounds and as such, it is important to us to provide an inclusive work environment for all. We do not discriminate on the basis of race, gender identity, age, religion, sexual orientation, veteran or disability status, or any other protected class. As an equal opportunity employer, we encourage and welcome people of all backgrounds to apply.
About Vanta
We started in 2018, in the wake of several high-profile data breaches. Online security was only becoming more important, but we knew firsthand how hard it could be for fast-growing companies to invest the time and manpower it takes to build a solid security foundation. Vanta was inspired by a vision to restore trust in internet businesses by enabling companies to improve and prove their security.From our early days automating security monitoring for compliance standards like SOC 2, HIPAA and ISO 27001 to creating the world’s leading Trust Management Platform, our vision remains unchanged.
Now more than ever, making security continuous—not just a point-in-time check— is essential. Thousands of companies rely on Vanta to build, maintain and demonstrate their trust— all in a way that’s real-time and transparent.
