Federal Compliance, Security Technical Program Manager

CoreWeave is the AI Hyperscaler™, delivering a cloud platform of cutting edge services powering the next wave of AI. Our technology provides enterprises and leading AI labs with the most performant, efficient and resilient solutions for accelerated computing. Since 2017, CoreWeave has operated a growing footprint of data centers covering every region of the US and across Europe. CoreWeave was ranked as one of the TIME100 most influential companies of 2024.

As the leader in the industry, we thrive in an environment where adaptability and resilience are key. Our culture offers career-defining opportunities for those who excel amid change and challenge. If you’re someone who thrives in a dynamic environment, enjoys solving complex problems, and is eager to make a significant impact, CoreWeave is the place for you. Join us, and be part of a team solving some of the most exciting challenges in the industry.  

CoreWeave powers the creation and delivery of the intelligence that drives innovation. 

What You’ll Do

The CISO organization is responsible for executing and delivering CoreWeave’s security, trust and assurance across its products, platforms, processes, and tools. The STA Federal Security Compliance team is building the foundation to align our larger GRC environment to federal cybersecurity requirements. As a Federal Security Compliance TPM, you will be a founding member of this newly created team, leading the charge to establish the governance program around USG federal regulations for the CoreWeave product suite.

About the Role:

This is a highly technical, hands-on leadership role. You will combine deep engineering skills with a comprehensive understanding of GRC principles to build out our compliance practices and work with our engineers to identify the correct, compliance solution. Your work will directly impact CoreWeave's ability to achieve certification, strengthen customer trust, and enable secure growth across all products and environments. 

In this role, you will:

• Own Agency‑ATO for FedRAMP High: Drive end‑to‑end authorization activities (plan, assess, authorize), including SSP, SAP, SAR, POA&M, Significant Change Requests, and audit‑ready evidence; coordinate with the agency AO and 3PAO through initial and annual assessments and package maintenance.
• Run ConMon like a program: Lead monthly/quarterly/annual deliverables, vuln/patch SLAs, scan quality, inventory integrity, control effectiveness reviews, and multi‑agency collaboration mechanics.
• Bridge compliance ↔ engineering: Translate NIST SP 800‑53 Rev. 5 / RMF / ISCM requirements into user stories, backlog items, and technical designs (logging/monitoring, IR, boundary definitions, inheritance, least privilege) in daily partnership with product engineering, security engineering, and operations.
• Scale with automation (OSCAL strongly preferred): Use or help mature OSCAL artifacts/validation to streamline evidence and package updates; ensure documentation stays synchronized with deployed configurations.
• Prepare for DoD IL5: Advise on Cloud SRG/SCCA/FedRAMP+ implications, boundary patterns, and inherited controls for IL4/IL5.
• Support AI‑related governance (nice to have): Help product/security teams align AI features with NIST AI RMF and relevant OMB policy (e.g., M‑25‑21) without owning the enterprise AI program.
• Deal support (as needed): Answer security questionnaires, map inherited controls, and guide reuse/leveraging conversations with agencies and DIB contractors.

Who You Are:

• 6+ years in cybersecurity/audit/compliance, including 4+ years directly in federal security programs (FedRAMP High/Moderate or NIST RMF) with hands‑on authorship of SSP/POA&M and coordination of assessments/3PAO.
• Demonstrated experience running FedRAMP ConMon (monthly/quarterly/annual) and managing significant changes with agencies.
• Strong working knowledge of NIST SP 800‑53 Rev. 5, SP 800‑37 (RMF), and SP 800‑137 (ISCM); able to map controls to real architectures and dev/ops workflows.
• Multi‑cloud background (AWS GovCloud, Azure Government, Google Public Sector, or equivalent public/commercial regions) and comfort discussing shared responsibility/inheritance.
• Certifications: CISSP or CISA (required).
• Proven ability to work with engineers and translate compliance to technical speak, from control interpretation to actionable design and test crite