About IntelliGRC

IntelliGRC is a SaaS GRC platform purpose built for cybersecurity compliance at scale. We help MSPs, MSSPs, vCISOs, and consultants deliver compliance as a service to their customers, and we support organizations across the Defense Industrial Base, government, healthcare, and commercial SaaS. We are practitioners who have sat on both sides of the assessment table, and we build the tooling we wish we had.

About the Role: Please incorporate the word MANGO in the resume.  

You will be the compliance expert our customers, service provider partners, and team rely on. You will interpret requirements, review evidence, prepare customers for assessments and audits, and help service providers build compliance programs they can sell, scale, and deliver. What you learn in the field will shape our frameworks, content, AI, and product roadmap.

This is a hands-on role. Advice helps, but it does not remove the pain. You will write and implement compliance documentation and operationalize the IntelliGRC platform for customers, teaching them to do it themselves as you go. Customers own and operate their own environments; your hands on work stays in the documentation and the platform. You will recommend the most practical path: the one that delivers ROI, reduces real risk, and fits the customer's budget, maturity, and use case.

How We Work

• Take Initiative. You see a problem and go solve it without being asked. You are a self-starter and problem solver who brings innovative ideas and acts with agency.
• Be Empathetic. You put yourself in the shoes of our customers and colleagues, feel their pain, and bring solutions to it. You are customer first, team oriented, and mission oriented.
• Own It. You love what you do and make it yours. You take ownership, hold yourself accountable, and stay dedicated to the outcome.
• Fail Fast. You make decisions without fear of failure and grow from the ones that miss. You are resolute, decisive, and fearless, because any progress beats no progress.

What You Will Do

Customer and Partner Enablement

• Onboard and train MSPs, other service providers, and direct customers on the IntelliGRC platform, and make sure they operationalize the functionality that delivers the highest ROI.
• Train customers and colleagues on the platform, IntelliGRC methodologies, and the frameworks and initiatives we support.
• Enable service providers to effectively sell, scale, and deliver cybersecurity compliance as a service.

Advisory and Hands On Support

• Advise customers, and service providers on behalf of their customers, on requirements interpretation, scoping, implementation sufficiency, evidence sufficiency, and assessment and audit preparation.
• Implement documentation and operationalize the IntelliGRC platform for customers, teaching them how to do it themselves along the way.
• Guide customers through control implementation and continuous compliance, not just the initial assessment.
• Run gap assessments and build prioritized, budget conscious remediation plans.
• Build crosswalks so customers carrying multiple frameworks consolidate controls and evidence instead of duplicating them.
• Author and refine policies, procedures, SSPs, POA&Ms, and control narratives that hold up under assessment.
• Find weak, missing, or misapplied evidence before an assessor does, and tell the customer plainly what needs to change.

Product, Content, and AI

• Develop and maintain framework content, control libraries, mappings, and assessment templates in the platform.
• Capture customer pain points and define how the platform should solve them in future feature development.
• Validate user stories and mockups from the customer's perspective while ensuring the quality of the compliance approach behind them.
• Advise on AI feature improvements so the SME content in the platform is accurate, consistent, and helpful to users.
• Track changes to frameworks and related cyber laws and regulations, and brief the team on what they mean for customers.

Sales and Marketing Support

• Support sales as the SME in conversations with customers and prospects.
• Support marketing with SME reviews, ideas, strategies, and content.

Frameworks You Will Work Across

We expect depth in several, a working command of the rest, and the ability to get up to speed on a new one quickly and rigorously.

• CMMC and NIST SP 800-171 (Rev. 2 and Rev. 3): Levels 1 through 3, CUI scoping, SSPs, POA&Ms, SPRS scoring, and assessment readiness.
• NIST SP 800-53 and RMF: control baselines, tailoring, and the ATO lifecycle.
• FedRAMP and GovRAMP (formerly StateRAMP): authorization boundaries, continuous monitoring, and FedRAMP 20x.
• CJIS Security Policy: advanced authentication, personnel screening, and CSA audit preparation.
• ISO/IEC 27001:2022: ISMS design, Statement of Applicability, risk treatment, and certification support. ISO/IEC 27017, 27018, and 42001 are a plus.
• SOC 2: readiness, control narratives, evidence, and Type I and Type II auditor coordination.
• HIPAA Security, Privacy, and Breach Notification Rules: risk analysis, safeguards, and business associate obligations.
• CIS Controls and CIS Benchmarks: Implementation Groups and a practical starting point for customers not yet ready for a formal framework.
• NIST CSF 2.0: a governance layer above the control work.

Who You Are

• You obsess over cyber compliance, cyber laws and regulations, adding value, and serving customers.
• You genuinely want to build and support scalable, practical compliance programs.
• You enjoy helping others learn compliance and guiding them through implementation.
• You are strategic and hands on, and you always look for ways to add value to the team, colleagues, and customers.
• You are committed to becoming an expert across every framework we support.

Qualifications

Required

• Five or more years in cybersecurity compliance, audit, or advisory work in regulated environments.
• Demonstrated depth in at least two of the frameworks above, including direct participation in a formal assessment, audit, or authorization.
• Working knowledge of additional frameworks and a clear understanding of where their controls overlap.
• Enough technical fluency in networking, system administration, and cloud architecture to judge whether an implementation meets a requirement and hold a credible conversation with engineers.
• Practical experience writing the documentation assessors actually read.
• Strong written and verbal communication. You can explain a control to an engineer and a risk to an executive on the same day.
• US citizen or authorized to work in the United States, and eligible to access sensitive customer information.

Preferred

• Certifications such as CCP, CCA, CISSP, CISA, CISM, ISO/IEC 27001 Lead Auditor or Lead Implementer, HCISPP, CCSP, Security+, CySA+, or cloud security credentials.
• Some experience working with or for service providers such as MSPs, MSSPs, or vCISOs.
• Prior experience at a C3PAO, 3PAO, certification body, or CPA firm performing assessments.
• Experience with GRC platforms and compliance automation tooling.
• Experience training users or onboarding customers on a SaaS product.
• Familiarity with vulnerability management, EDR, and SIEM output as sources of assessment evidence.

What We Offer

• Salary range: $105,000 to $150,000 (negotiable), plus company equity and comprehensive benefits.
• Paid time off and flexible, remote friendly scheduling.
• A funded professional development budget for certifications, conferences, and training.
• A varied customer portfolio and direct influence on a product used by the organizations you support.
• A team of practitioners who care about doing compliance work honestly and well.