--- title: 'Governance, Risk & Compliance (GRC) Analyst at Gallatin' canonical: 'https://feeny.ai/job/governance-risk-compliance-grc-analyst-gallatin-washington-022tmfnhqnsp' type: 'job' last_seen: '2026-11-10' --- # Governance, Risk & Compliance (GRC) Analyst at Gallatin - **Company:** Gallatin - **Location:** Washington, DC - **Employment:** full-time - **Work type:** onsite - **Posted:** 2026-11-10 - **Last confirmed live:** 2026-11-10 - **Apply:** https://jobs.ashbyhq.com/gallatin/72a48a00-fd2b-4cdc-8ad0-38ae79e361c6 ## Job description ## About Gallatin At Gallatin, we are rebuilding logistics infrastructure for the national security missions of the United States and allied partners. We build AI systems that determine how logistics decisions are made, not just how they're executed. From factory to foxhole, we operate at the layer where data becomes decisions, and decisions make the advantage. ## About the Role Gallatin is looking for a GRC Analyst to build and run the security compliance program that lets our AI platforms operate inside the Department of Defense. You'll own the path from "great product" to "authorized to operate": driving Risk Management Framework (RMF) packages, maintaining our NIST SP 800-171 and CMMC posture, and making sure the data our customers entrust to us is governed with the rigor the mission demands. This is a hands-on, high-ownership role for someone who treats compliance as an engineering problem, not a paperwork exercise. You'll sit between our engineering teams, our customers' ISSMs and authorizing officials, and our leadership, translating control requirements into implementable work and translating our systems into evidence assessors trust. (Note: This position requires Active Secret clearance required; Top Secret / SCI eligible preferred) ## What You'll Do Authorization & Accreditation - Drive RMF authorization packages for Gallatin products deployed across DoD environments, from system categorization and control selection through assessment and ATO. - Own the System Security Plan (SSP), Plans of Action & Milestones (POA&Ms), and supporting artifacts, keeping them current as systems and deployments change. - Serve as Gallatin's day-to-day counterpart to customer ISSMs, ISSOs, and assessors, answering questions, closing findings, and keeping authorizations on schedule. - Coordinate data sharing agreements and interconnection documentation with government partners and adjacent programs. Compliance Program Management - Build and maintain Gallatin's compliance posture against NIST SP 800-171, CMMC Level 2, and NIST SP 800-53, with an eye toward FedRAMP and DoD Impact Level requirements (IL5/IL6). - Run continuous monitoring: control testing, evidence collection, vulnerability and scan-result tracking, and remediation follow-through with engineering. - Write and maintain security policies, procedures, and standards that reflect how we actually operate. - Prepare for and lead internal audits and third-party assessments. FedRAMP & Cloud Authorization - Lead Gallatin's FedRAMP readiness and authorization effort, from readiness assessment and boundary definition through agency sponsorship and authorization. - Map our cloud architecture to the FedRAMP Moderate and High baselines and to DoD Cloud Computing SRG Impact Levels (IL4/IL5), identifying gaps and driving remediation with Engineering. - Develop and maintain the FedRAMP package, including the SSP and its appendices, control implementation summaries, and the continuous monitoring plan. - Coordinate with Third Party Assessment Organizations (3PAOs) and agency sponsors through assessment. - Track FedRAMP program changes (including FedRAMP 20x and Rev. 5 baseline updates) and advise leadership on the fastest credible path to authorization. Risk Management - Maintain Gallatin's risk register, identifying, assessing, and tracking security and compliance risks across our products, infrastructure, and vendors. - Evaluate third-party and supply chain risk for the tools, services, and partners we bring into our environments. - Brief leadership on risk posture, open findings, and the tradeoffs behind remediation priorities. Enablement & Automation - Partner with Engineering and SRE to embed security controls into infrastructure-as-code, CI/CD, and deployment workflows so compliance is built in, not bolted on. - Use modern tooling and AI to automate evidence collection and documentation, increasing the speed at which we can move through authorization. - Support growth and proposals with security questionnaires, compliance responses, and capability statements. ## What We’re Looking For - Active Secret clearance, with the ability to obtain and maintain Top Secret / SCI. - 3+ years of experience in GRC, cybersecurity compliance, or information assurance, ideally supporting DoD or federal systems. - Direct experience supporting software authorizations at IL4/IL5/IL6 - Hands-on experience with the DoD RMF process (DoDI 8510.01) and authoring SSPs, POA&Ms, and control implementation statements. - Working knowledge of NIST SP 800-53, NIST SP 800-171, CMMC, and CUI handling requirements (DoDI 5200.48). - Working knowledge of the FedRAMP authorization process, baselines, and package requirements, and of the DoD Cloud Computing SRG and Impact Levels. - A track record of working directly with government stakeholders (ISSMs, AOs, or assessors) and moving packages to approval. - Ability to work cross-functionally with engineers, understanding cloud architecture well enough to assess and document controls accurately. - Familiarity with eMASS, GRC platforms, and cloud security tooling (AWS GovCloud, Azure Government, or similar). - Clear, precise writing and the judgment to know when a control is genuinely met and when it is not. - Willingness to travel 10–25% to customer and government sites. Bonus Points - Security certifications such as CISSP, CISM, CAP/CGRC, Security+, or CMMC Certified Professional/Assessor. - Experience taking an AI/ML or SaaS product through a DoD authorization or FedRAMP process. - Direct experience supporting FedRAMP authorizations, either at a cloud service provider or a 3PAO. - Experience in a startup or early-stage environment. - Military or government background in cybersecurity, information assurance, or logistics. - Experience with policy-as-code or compliance automation tooling. Mission and Identity We are building the system that enables faster, smarter logistics decisions in contested environments, and we're doing it with a team of seasoned entrepreneurs, operators, and technologists who have built and scaled solutions in this space before. We hold ourselves to an extremely high standard. We value clear thinking, direct communication, and the kind of ownership that doesn't stop until something actually works. Our mission is to create decision advantage when the stakes are the highest. If we succeed, the system doesn't just run; it gets smarter. We're not building AI for its own sake. We're building it because faster, smarter decisions in the most demanding environments on earth can't wait. If you want to work somewhere the stakes are real and the mission is urgent — you'll fit in here. Why Gallatin? The logistics infrastructure that supports America's warfighters and humanitarian disaster responders is overdue for transformation, and we are building it. From defense operations to disaster response, we're solving the hardest problems that keep missions moving when it matters most. Join a team where the mission is the point. Compensation: Gallatin offers competitive compensation commensurate with experience. Actual compensation may vary based on experience, skills, and location. In addition to base salary, we offer a generous equity grant, full healthcare coverage, 401k, unlimited PTO, and the perks of working in a high-caliber, mission-driven environment. Gallatin is an equal opportunity employer. We do not discriminate on the basis of race, color, religion, sex, national origin, age, disability, veteran status, sexual orientation, gender identity, or any other characteristic protected by applicable federal, state, or local law. This position may require the ability to obtain and maintain a U.S. government security clearance. The successful candidate must be able to work in a classified environment when necessary. We comply with the United States Department of Labor's[Pay Transparency provision](https://www.dol.gov/sites/dolgov/files/ofccp/pdf/pay-transp_English_unformattedESQA508c.pdf). Note: Due to the nature of certain government contracts held by this organization, U.S. citizenship is a requirement for all positions at Gallatin. Proof of citizenship will be required prior to employment if selected. ## About Gallatin ## Company Overview - **One-liner**: Gallatin builds an AI-native logistics platform that enables military planners to predict, plan, and execute supply chain operations in contested environments. - **Entity Type**: Private (Seed – $15M raised) - **Headquarters**: El Segundo, California, USA (additional offices in Washington, DC and Austin, TX) - **Founded**: 2024 - **Founders**: Woody Glier (CEO), Daniel Buchmueller (CTO), Brian Ballard (CPO) ## Core Business - **Primary industry**: Defense technology / military logistics - **Target customers**: U.S. Department of Defense, allied militaries, and defense organizations (B2G) - **Mission**: Provide decision advantage in logistics, no matter the obstacle – modernizing defense supply chains with AI-driven tools. ## Products & Services - **[Navigator]**: AI-powered logistics platform that integrates real-time data, generates courses of action, and runs simulations to accelerate resupply workflows. It addresses first, middle, and last-mile challenges at tactical, operational, and strategic levels. (Type: SaaS / AI platform) ## Market Standing - **Valuation**: Not disclosed (seed stage) - **Key Metric**: $15.0M total funding (seed round led by 8VC, April 2025) - **Notable Investors/Partners**: 8VC (lead), Silent Ventures, Moonshots Capital, Timeless Partners, Banter Capital. Incubated by 8VC’s Build program (also launched Epirus and Saronic). Awarded a U.S. Army PORTAL contract. - **Growth Signals**: Headcount grew 213% YoY (~40 employees as of mid-2026); 45 active job postings; offices opened in Austin and DC; multiple pilot programs with major defense customers. ## Competitive Advantages - **Deep domain expertise**: Founding team with experience at Palantir, Scale AI, Amazon Prime Air, DoD, and U.S. intelligence community. - **First-mover in AI-defense logistics**: Addresses a critical vulnerability in modern military supply chains, using predictive analytics and automation long proven in commercial logistics. - **Government traction**: Already awarded an Army contract and working directly with military services, creating high barriers to entry. - **Talent pool**: Employees drawn from elite defense and AI companies (Palantir, Scale AI, Saronic, Kong, etc.). ## Strategic Focus - Scale the Navigator platform across all military services. - Expand engineering and deployment teams in direct proximity to customers (DC, El Segundo, Austin). - Build on key partnerships and pilot programs to drive adoption in contested logistics environments. ## Why Work Here - **Culture**: In-person, mission-driven environment with offices in Washington, DC, Austin, TX, and El Segundo, CA. The company emphasizes tackling hard problems with real-world impact. - **Hybrid/Remote**: Hybrid workspace – employees engage in a mix of remote and on-site work; travel to customer locations may be required. - **Security Clearance**: Some positions require U.S. citizenship and ability to obtain/maintain a security clearance (TS/SCI). Not required for all roles. - **Benefits**: Competitive salary, comprehensive health coverage, life and disability insurance, open paid time off, monthly gym/wellness reimbursement, healthy office meals. - **Growth**: Rapidly scaling startup with strong funding and a clear mission – opportunity to shape early-stage product and culture. ## Sources 1. [gallatin.ai – Company Page](https://www.gallatin.ai/company) 2. [gallatin.ai – Careers Page](https://www.gallatin.ai/careers) 3. [LinkedIn – Gallatin AI Company Profile](https://www.linkedin.com/company/gallatinai) 4. [Built In – Gallatin AI Careers & Culture](https://builtin.com/company/gallatin-ai-inc) 5. [PRNewswire – Gallatin Emerges from Stealth with $15M Seed](https://www.prnewswire.com/news-releases/gallatin-emerges-from-stealth-with-15m-seed-investment-to-transform-defense-logistics-302422537.html) 6. [Ashby Jobs Board – Gallatin Open Positions](https://jobs.ashbyhq.com/gallatin) ## Other roles at Gallatin - [Senior Product Manager, Navigator](https://feeny.ai/job/senior-product-manager-navigator-gallatin-austin-8fnapghmx5d3) — Austin, TX - [Senior Data Engineer (Data Platform)](https://feeny.ai/job/senior-data-engineer-data-platform-gallatin-el-segundo-v8krdvzhkne3) — El Segundo, CA - [Infrastructure Engineer](https://feeny.ai/job/infrastructure-engineer-gallatin-el-segundo-69kehnwb233x) — El Segundo, CA - [Senior Director, Solutions Architecture](https://feeny.ai/job/senior-director-solutions-architecture-gallatin-austin-72vgcw05dfwb) — Austin, TX - [Fullstack Engineer](https://feeny.ai/job/fullstack-engineer-gallatin-el-segundo-174cd0waa1qb) — El Segundo, CA - [Senior Frontend Engineer](https://feeny.ai/job/senior-frontend-engineer-gallatin-el-segundo-pgrhmg6fm007) — El Segundo, CA - [Engagement Manager, Special Projects](https://feeny.ai/job/engagement-manager-special-projects-gallatin-washington-z3xk8z2v9ft1) — Washington, DC - [Engagement Manager](https://feeny.ai/job/engagement-manager-gallatin-austin-2e46y40n8nyg) — Austin, TX - [Backend Engineer](https://feeny.ai/job/backend-engineer-gallatin-el-segundo-t1tcc5zs8zg7) — El Segundo, CA - [AI Software Engineer](https://feeny.ai/job/ai-software-engineer-gallatin-el-segundo-pbcak1gf9n7r) — El Segundo, CA