Senior Technical Compliance Analyst

About the job

Description

MongoDB’s Compliance team leads the strategy, execution, and maintenance of the company’s global security certifications and regulatory requirements. The team translates complex obligations into scalable operational processes and maintains an audit-ready posture across a broad portfolio of frameworks and markets.

The Senior Compliance Analyst is a senior individual-contributor role that leads high-stakes audits and specialized compliance workstreams.

We act as the primary interface between external auditors and our internal Product, Engineering, and Legal teams. Our goal is to translate complex regulatory requirements into scalable operational processes, maintaining a compliant and audit-ready posture across our diverse portfolio.

Senior Technical Compliance Analyst (Public Sector) is a senior-level individual contributor role responsible for the lifecycle management of our most sensitive US government authorizations. This role acts as a lead for high-stakes workstreams involving FedRAMP High, DoD IL5+, CJIS, and ITAR. Unlike the Analyst level, this role takes full ownership of complex federal assessments and leads the continuous monitoring strategy for our Atlas for Government product. This role is a key resource for interpreting NIST 800-53 controls and translating them into technical requirements for our engineering teams. A requirement for this role is to be a US Citizen.

This role will be based remotely in United States.

Key Responsibilities

• Lead end-to-end external audits and certifications, coordinating scoping, audit plans, evidence, auditor engagement, findings, and final outcomes
• Own internal audit cadences and remediation tracking; establish clear accountability for findings, milestones, dependencies, and resolution timelines, and drive timely follow-through with technical teams
• Serve as a lead point of contact for auditors and enterprise customers during security reviews and audit deep-dives; explain MongoDB’s control environment with clarity and confidence
• Map regulatory requirements to the central control framework and conduct gap analyses for new frameworks, jurisdictions, and market expansions
• Assess compliance-program maturity and report material risks, gaps, trends, and delivery status to team and business leaders
• Author and review customer-facing security documentation and audit evidence, ensuring it accurately reflects MongoDB’s controls and architectural guardrails
• Lead cross-functional workstreams that advance the ARC roadmap; identify risks and dependencies early and recommend practical improvements to processes and tooling
• Build and maintain executive and operational dashboards and Jira workflows for control performance, audit findings, and remediation progress; mentor stakeholders on compliance practices
• Lead the end-to-end execution of federal assessments, coordinating with Third Party Assessment Organizations (3PAOs), agency sponsors, and the FedRAMP PMO
• Manage the federal continuous monitoring (ConMon) program, including the timely analysis and reporting of vulnerabilities and the maintenance of the POA&M
• Lead the annual update and technical review of core FedRAMP artifacts, including the System Security Plan (SSP), Contingency Plan (ISCP), and Incident Response Plan (IRP)
• Act as a technical advisor to Engineering and Operations teams to ensure cloud configurations (e.g., FIPS 140-2, boundary protection, and access control) meet federal and DoD IL5+ mandates

Expectations

• Operate independently in ambiguous, complex situations and exercise sound judgment with minimal supervision
• Take accountability for program outcomes—not only task tracking—and proactively surface risks, trade-offs, and decisions that require escalation
• Influence technical and business stakeholders across teams and levels to deliver sustainable compliance outcomes
• Communicate regulatory intent and technical control requirements in concise, actionable language for both technical and non-technical audiences

Scope and Complexity

The role manages overlapping audit cycles and compliance work across international jurisdictions and across highly regulated sectors such as financial services, healthcare, and government. Work ranges from complex evidence and control assessments to interpreting emerging requirements and identifying how controls can satisfy multiple standards.

The scope is deeply technical and specialized for the US Federal, State, and Local Government markets.

You will navigate the complexity of mapping shared controls across multiple specialized frameworks, ensuring a single remediation effort satisfies FedRAMP, CJIS, and ITAR requirements simultaneously.

Authority and Impact

The Senior Compliance Analyst has the authority to lead federal assessment project streams and represent MongoDB in technical reviews with 3PAOs and federal agencies.Your work directly enables MongoDB to secure and maintain the authorizations required to serve the Department of Defense and civilian agencies, protecting a critical revenue stream.

Expertise and Leadership

The role develops deep subject-matter expertise in assigned frameworks and in how MongoDB’s cloud architecture satisfies their requirements. It serves as a trusted resource for mapping technical evidence to regulatory intent, leads complex projects such as internal audits and framework renewals, and mentors colleagues and partner teams on effective compliance practices.

Requirements

• Bachelor’s degree in a technical field (such as Information Systems, Computer Science, or Cybersecurity), or equivalent practical experience
• 7+ years of experience in GRC, Information Security, or IT Audit, preferably in a SaaS or cloud environment, with a heavy focus on US Public Sector frameworks (FedRAMP, DoD SRG, CJIS)
• Demonstrated experience leading technical audits or compliance programs
• Strong understanding of cloud security principles, risk management, and how controls operate in a cloud-native environment across AWS, Google Cloud, or Azure
• Deep understanding of NIST 800-53 and NIST 800-171 controls and how they are implemented within cloud architectures (AWS, GCP, or Azure)
• Proven track record of managing federal audits from kickoff through to the issuance of an Authorization to Operate (ATO)
• Exceptional ability to explain complex security configurations to government auditors and internal technical teams
• Advanced proficiency in Jira and Confluence to track control performance data and manage large-scale federal documentation projects
• Practical experience performing control mapping, gap analyses, remediation oversight, and program or control-maturity assessments
• Advanced proficiency with Jira or similar tools for managing audit findings, control data, and high-volume remediation workflows
• Excellent written and verbal communication skills, including the ability to lead auditor/customer discussions and translate technical requirements for non-technical audiences
• Certifications such as CISA, CRISC, CISSP, or ISO Lead Implementer are preferred

About MongoDB

MongoDB is built for change, empowering our customers and our people to innovate at the speed of the market. We have redefined the data platform for the AI era, enabling builders to create, transform, and disrupt industries with software. MongoDB’s unified data platform, the most widely available, globally distributed data platform on the market, helps organizations modernize legacy workloads, embrace innovation, and unleash AI. Our cloud-native platform, MongoDB Atlas, is the only globally distributed, multi-cloud data platform and is available across AWS, Google Cloud, and Microsoft Azure.

With offices worldwide and over 67,000 customers, including AI-native startups and approximately 75% of the Fortune 100, relying on MongoDB for their most important applications, we’re powering the next era of software.

Our compass at MongoDB is our Leadership Commitment, guiding how and why we make decisions, show up for each other, and win. It’s what makes us MongoDB.