Staff GRC Analyst (Cloud Security)

Location: Remote within the United States. Applicants must be authorized to work for any employer in the U.S.; visa sponsorship is not available.

Target annual compensation: $215,000–$230,000

Company

Tines is an intelligent workflow company providing a secure, vendor-agnostic automation platform for IT and security teams.

What you will do

• Translate FedRAMP High, DoD IL4/IL5, CMMC, NIST SP 800-53/800-171, SOC 2, ISO, and other requirements into technical controls across AWS and Azure.
• Assess infrastructure, networking, containers, databases, IAM, encryption, logging, and vulnerability management implementations.
• Define evidence requirements, validate controls with technical teams, identify gaps, and drive remediation.
• Support FedRAMP authorization and ongoing operations, including ConMon, POA&M management, vulnerability reporting, evidence packages, and significant change management.
• Support external assessments, 3PAO engagements, and audit readiness.
• Monitor evolving federal requirements, including FedRAMP 20x, and scale compliance through automation and policy-as-code.

Requirements

• 12+ years of experience in security compliance, technical GRC, cloud security, IT audit, or related technical governance roles.
• Hands-on experience translating compliance requirements into technical controls and configuration standards.
• Strong knowledge of cloud and SaaS security, including IAM, encryption, logging, vulnerability management, and secure SDLC.
• Experience supporting FedRAMP authorization, ConMon, POA&M management, and external assessments.
• U.S. work authorization for any employer is required.

Nice to have

• PMP, CISSP, CISM, CISA, or CCSP certification.

Culture & Benefits

• Values centered on simplicity, speed, soundness, curiosity, growth, and integrity.
• Cross-functional collaboration with Security, Engineering, Product, IT, and Legal.
• Remote work from within the United States.