Senior Technical Compliance Analyst

Description MongoDB’s Compliance team leads the strategy, execution, and maintenance of the company’s global security certifications and regulatory requirements. The team translates complex obligations into scalable operational processes and maintains an audit-ready posture across a broad portfolio of frameworks and markets. The Senior Compliance Analyst is a senior individual-contributor role that leads high-stakes audits and specialized compliance workstreams. We act as the primary interface between external auditors and our internal Product, Engineering, and Legal teams. Our goal is to translate complex regulatory requirements into scalable operational processes, maintaining a compliant and audit-ready posture across our diverse portfolio. Senior Technical Compliance Analyst (Public Sector) is a senior-level individual contributor role responsible for the lifecycle management of our most sensitive US government authorizations. This role acts as a lead for high-stakes workstreams involving FedRAMP High, DoD IL5+, CJIS, and ITAR. Unlike the Analyst level, this role takes full ownership of complex federal assessments and leads the continuous monitoring strategy for our Atlas for Government product. This role is a key resource for interpreting NIST 800-53 controls and translating them into technical requirements for our engineering teams. A requirement for this role is to be a US Citizen. This role will be based remotely in United States. Key Responsibilities • Lead end-to-end external audits and certifications, coordinating scoping, audit plans, evidence, auditor engagement, findings, and final outcomes • Own internal audit cadences and remediation tracking; establish clear accountability for findings, milestones, dependencies, and resolution timelines, and drive timely follow-through with technical teams • Serve as a lead point of contact for auditors and enterprise customers during security reviews and audit deep-dives; explain MongoDB’s control environment with clarity and confidence • Map regulatory requirements to the central control framework and conduct gap analyses for new frameworks, jurisdictions, and market expansions • Assess compliance-program maturity and report material risks, gaps, trends, and delivery status to team and business leaders • Author and review customer-facing security documentation and audit evidence, ensuring it accurately reflects MongoDB’s controls and architectural guardrails • Lead cross-functional workstreams that advance the ARC roadmap; identify risks and dependencies early and recommend practical improvements to processes and tooling • Build and maintain executive and operational dashboards and Jira workflows for control performance, audit findings, and remediation progress; mentor stakeholders on compliance practices • Lead the end-to-end execution of federal assessments, coordinating with Third Party Assessment Organizations (3PAOs), agency sponsors, and the FedRAMP PMO • Manage the federal continuous monitoring (ConMon) program, including the timely analysis and reporting of vulnerabilities and the maintenance of the POA&M • Lead the annual update and technical review of core FedRAMP artifacts, including the System Security Plan (SSP), Contingency Plan (ISCP), and Incident Response Plan (IRP) • Act as a technical advisor to Engineering and Operations teams to ensure cloud configurations (e.g., FIPS 140-2, boundary protection, and access control) meet federal and DoD IL5+ mandates Expectations • Operate independently in ambiguous, complex situations and exercise sound judgment with minimal supervision • Take accountability for program outcomes—not only task tracking—and proactively surface risks, trade-offs, and decisions that require escalation • Influence technical and business stakeholders across teams and levels to deliver sustainable compliance outcomes • Communicate regulatory intent and technical control requirements in concise, actionable language for both technical and non-technical audiences Scope and Complexity The role manages overlapping audit cycles and compliance work across international jurisdictions and across highly regulated sectors such as financial services, healthcare, and government. Work ranges from complex evidence and control assessments to interpreting emerging requirements and identifying how controls can satisfy multiple standards. The scope is deeply technical and specialized for the US Federal, State, and Local Government markets. You will navigate the complexity of mapping shared controls across multiple specialized frameworks, ensuring a single remediation effort satisfies FedRAMP, CJIS, and ITAR requirements simultaneously. Authority and Impact The Senior Compliance Analyst has the authority to lead federal assessment project streams and represent MongoDB in technical reviews with 3PAOs and federal agencies.Your work directly enables MongoDB to secure and maintain the authorizations required to serve the Department of Defense and civilian agencies, protecting a critical revenue stream. Expertise and Leadership The role develops deep subject-matter expertise in assigned frameworks and in how MongoDB’s cloud architecture satisfies their requirements. It serves as a trusted resource for mapping technical evidence to regulatory intent, leads complex projects such as internal audits and framework renewals, and mentors colleagues and partner teams on effective compliance practices. Requirements • Bachelor’s degree in a technical field (such as Information Systems, Computer Science, or Cybersecurity), or equivalent practical experience • 7+ years of experience in GRC, Information Security, or IT Audit, preferably in a SaaS or cloud environment, with a heavy focus on US Public Sector frameworks (FedRAMP, DoD SRG, CJIS) • Demonstrated experience leading technical audits or compliance programs • Strong understanding of cloud security principles, risk management, and how controls operate