Senior Compliance Analyst, Snowgov Compliance

As a Senior Compliance Analyst, Snowgov Compliance at Snowflake, you will:

• Own and maintain core FedRAMP authorization artifacts, including the System Security Plan (SSP), Contingency Plan (ISCP), and Incident Response Plan (IRP), keeping them accurate and updated annually.

• Manage the lifecycle of Plans of Action and Milestones (POA&M), tracking findings, risks, and remediation commitments through closure with clear ownership and realistic deadlines.

• Coordinate annual 3PAO assessments and continuous monitoring, acting as the primary liaison between Snowflake, assessors, and federal agency stakeholders.

• Advise Engineering and Operations teams so cloud configurations (FIPS 140-3 validation, boundary protection, access control, logging and monitoring) meet federal and DoD mandates.

• Perform gap analyses for new or evolving public sector requirements, such as emerging CMMC or GovRAMP mandates and FedRAMP Consolidated Rules, and define technical remediation roadmaps.

• Respond to customer and regulator inquiries about Snowflake's public sector security and compliance obligations, and build self-service resources so customers and field teams can increasingly answer these questions themselves.

Our ideal Senior Compliance Analyst, Snowgov Compliance will have:

• 5+ years of experience in risk management, compliance, GRC, or a related governance function within a regulated or public sector environment preferred.

• Working knowledge of NIST SP 800-53 controls and the FedRAMP authorization process.

• Experience contributing to SSPs, POA&Ms, contingency plans (ISCP), and incident response plans (IRP).

• Experience writing and maintaining audit-ready governance artifacts, including policies, standards, procedures, and control narratives.

• Experience coordinating with 3PAOs, auditors, or assessors during annual assessments or continuous monitoring cycles.

• Ability to influence stakeholders across Engineering, IT, Legal, and Security to drive control implementation and remediation without direct authority.

• Strong organizational skills, with the ability to manage multiple concurrent audit and assessment timelines and track findings through closure.

• Experience using AI to automate or streamline manual compliance workflows.

Bonus points for the following:

• CISSP, CISM, CISA, or other information security certifications

• Experience with DoD Impact Level authorizations and CMMC certification