Governance, Risk & Compliance (GRC) Analyst
About Gallatin
==================
At Gallatin, we are rebuilding logistics infrastructure for the national security missions of the United States and allied partners. We build AI systems that determine how logistics decisions are made, not just how they're executed. From factory to foxhole, we operate at the layer where data becomes decisions, and decisions make the advantage.
About the Role
==================
Gallatin is looking for a GRC Analyst to build and run the security compliance program that lets our AI platforms operate inside the Department of Defense. You'll own the path from "great product" to "authorized to operate": driving Risk Management Framework (RMF) packages, maintaining our NIST SP 800-171 and CMMC posture, and making sure the data our customers entrust to us is governed with the rigor the mission demands.
This is a hands-on, high-ownership role for someone who treats compliance as an engineering problem, not a paperwork exercise. You'll sit between our engineering teams, our customers' ISSMs and authorizing officials, and our leadership, translating control requirements into implementable work and translating our systems into evidence assessors trust.
What You'll Do
==================
Authorization & Accreditation
- Drive RMF authorization packages for Gallatin products deployed across DoD environments, from system categorization and control selection through assessment and ATO.
- Own the System Security Plan (SSP), Plans of Action & Milestones (POA&Ms), and supporting artifacts, keeping them current as systems and deployments change.
- Serve as Gallatin's day-to-day counterpart to customer ISSMs, ISSOs, and assessors, answering questions, closing findings, and keeping authorizations on schedule.
- Coordinate data sharing agreements and interconnection documentation with government partners and adjacent programs.
###
Compliance Program Management
- Build and maintain Gallatin's compliance posture against NIST SP 800-171, CMMC Level 2, and NIST SP 800-53, with an eye toward FedRAMP and DoD Impact Level requirements (IL5/IL6).
- Run continuous monitoring: control testing, evidence collection, vulnerability and scan-result tracking, and remediation follow-through with engineering.
- Write and maintain security policies, procedures, and standards that reflect how we actually operate.
- Prepare for and lead internal audits and third-party assessments.
FedRAMP & Cloud Authorization
- Lead Gallatin's FedRAMP readiness and authori...
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.
Sed ut perspiciatis unde omnis iste natus error sit voluptatem accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae ab illo inventore veritatis.