[Hiring] Compliance Engineer @Wiz

Role Description

Come join the organization that is redefining security for the AI era. As one of the fastest-growing startups ever, we enable teams to secure cloud and AI applications by connecting code, cloud, and runtime into a single shared context.

We are seeking an experienced Compliance Engineer to serve as the strategic technical lead for Wiz’s FedRAMP CR26 initiative. You will define the long-term technical roadmap by architecting comprehensive compliance-as-code solutions, utilizing both Wiz's native features and custom-developed automations outside the platform to efficiently address CR26 Class D rule changes.

• Lead the technical roadmap for FedRAMP Continuous Monitoring, moving from manual reporting to an automated, real-time telemetry model.
• Architect compliance outcomes by translating NIST 800-53 Rev. 5 and FedRAMP CR26 rulesets into scalable engineering and product solutions.
• Engineer evidence generation frameworks, significantly reducing manual effort required for 3PAO assessments and automating compliance validation for control implementation verification.
• Conduct technical risk assessments, root-cause analysis on compliance findings, and provide guidance for implementation of compensating controls or hardening measures in cloud environments.
• Own the technical compliance documentation lifecycle, including Security Decision Records (SDRs).
• Collaborate cross-functionally with legal, product, engineering, devops, architecture, security, and federal customer teams to scope technical compliance verification and validation requirements for new features and services.
• Mentor others on FedRAMP/DoW compliance best practices and contribute to internal training programs.

Qualifications

• 6+ years of experience in security engineering, DevOps, and systems engineering, with a proven ability developing processes and writing code to solve security/compliance problems.
• 4+ years of expertise in NIST SP 800-53, FedRAMP High baselines, and DoW SRG overlays, with a proven ability to assess risk, reduce risk, and build engineering solutions that enable compliance.
• Deep understanding of the differences between FR 20x and CR26 ruleset for Rev5 authorizations and the impacts these rule changes have on Cloud Service Providers (CSPs).
• Experience working in a cloud-native environment with DevSecOps technologies, specifically including CI/CD, Containers, and Kubernetes.
• Strong proficiency in scripting and Infrastructure as Code (IaC), with specific requirements for Shell Scripting, Python, Terraform or OpenTofu, and Preferred AI Harness (Claude Code, OpenAI Codex).
• Experience with cloud platforms in government spaces.

Requirements

• Experience with AWS GovCloud.
• Experience in Azure Government, Google Cloud for Government (Assured Workloads), or equivalent and associated security services.
• Experience with DevSecOps technologies including Microservices, GitOps, and Observability / Logging / SIEM / Platforms.
• Experience with Packer, other Configuration as Code tools, and Policy as Code tools.
• Experience automating compliance validation using cloud-native tools.

Benefits

• Freedom to think creatively and dream big.
• Opportunity to contribute to significant growth.
• Collaborative and fun work environment.

Company Description

Trusted by security teams all over the world, we have a proven track record of success and a culture that values world-class talent. Our Wizards from all over the globe work together to protect the infrastructure of our customers, including over 65% of the Fortune 100, who trust us to scan and secure over 230 billion files daily.