FedRAMP Certification & Continuous Compliance

• Document the Cloud Service Offering (CSO) for 20x certification, including the production environment, data plane and data flows, management plane, security controls plane, and in-scope supporting services. As applicable, reconcile the proposed FedRAMP boundary against the most recent SOC 2 report’s scope.
• Complete gap assessment(s) and build capability to deliver all mandatory 20x KSIs, ensuring each has a correctly defined measure, an authoritative evidence source, an accountable owner, and a documented “Meets” status.
• Design and build the FedRAMP Trust Center, Security Inbox, and a machine-readable KSI evidence pipeline, normalizing signals from CSPM, IAM, SIEM, CI/CD, and vulnerability-scanning tools so certification data is generated from live systems rather than manually assembled spreadsheets.
• Partner with Product, Engineering, and Security leadership to embed FedRAMP controls directly into the SDLC and cloud infrastructure design, establishing control requirements, validating designs, and setting testable success criteria for “compliance as code” workstreams.
• Deliver the FedRAMP Marketplace listing and the full 20x Certification Package, carrying it through the FedRAMP PMO’s review process to FedRAMP certification.
• Operationalize the post-certification maintenance program: recurring KSI reviews, POA&M-style remediation tracking, and the required ongoing reporting cycle to FedRAMP (certification data changes, accepted vulnerabilities, transformative changes, agencies using the service, reportable incidents). Assess the security impact of proposed changes and prepare significant change submissions for the ISSM’s sign off.
• Procure or develop and deliver annual and role-based training in accordance with FedRAMP requirements and manage the associated records and compliance activities.
• Ensure implementation of all required non-technical controls, and manage day to day 3PAO, advisory, and accelerator vendor relationships as the program moves beyond Class A.
• Drive timely remediation of risks and control gaps surfaced through audits, vulnerability scans, and penetration tests; translate technical findings into business-risk context for internal executives and (where applicable) external parties; bring risk acceptance proposals to the ISSM; escalate high-risk blockers to the Head of Risk and Compliance and/or CISO.
• Define and track Key Security Indicators (KSIs) and Key Performance Indicators (KPIs) for the program, and support the Head of Risk and Compliance on related Key Risk Indicators (KRIs).
• Support other certifications on the roadmap, such as GovRAMP, HIPAA, and CJIS, and lead the workstreams assigned to you.
• Build the data-backed analysis behind the recommendation on whether and when to pursue higher level certification(s), grounded in Year 1 pipeline, conversion, and demand-signal data, including staffing, GovCloud, and cost implications, delivered in time to inform executive and board budget planning.

Security, Privacy and Reporting Responsibilities

• Safeguard the confidentiality, integrity, and availability of federal information and systems within the authorization boundary and protect from unauthorized access, use, disclosure, or misuse; report any instance of unauthorized access, use, or misuse through required channels.
• Comply with and help enforce personnel-security policies and procedures and acceptable-use/rules-of-behavior requirements for personnel in trusted roles.
• Report insider-threat indicators and security/suitability concerns promptly through designated channels; support insider-threat program requirements.
• Document and report security incidents within required timeframes.
• Support internal and external security assessments, audits, and agency reviews

What You Will Bring (Required)

• 6+ years of experience in GRC, information security compliance, or IT audit, including hands-on FedRAMP ISSO experience through at least one full Rev 5 authorization (typically about 3 years) at a SaaS or cloud software company.
• At least one of the following certifications: CRISC, CISM, CISA, CISSP, or an equivalent recognized security, risk, or audit management credential.
• Direct implementation of NIST SP 800-53 controls within a FedRAMP authorization. If you have one full authorization behind you, some FedRAMP 20x exposure is also expected.
• Working fluency across cloud (Azure, AWS) and platform security domains: IAM, encryption, vulnerability management, SIEM, and cloud configuration.
• Ability to work independently as an individual contributor: owning your deliverables, setting priorities for your workstreams, and knowing when to act on your own and when to bring an issue to the ISSM.
• Strong "manage by influence" track record: experience driving engineers, product managers, and other non-reporting stakeholders to deliver evidence, remediate findings, and meet audit deadlines.
• Direct experience managing external auditors, assessors, or certification bodies through full audit cycles.

Preferred Qualifications

• Experience with or exposure to FedRAMP 20x KSIs (not just Rev 5 process), and familiarity with higher-tier FedRAMP certifications (Moderate and High).
• Experience with related frameworks: DoD Impact Levels, GovRAMP/StateRAMP, CMMC, NIST 800-171, and CUI handling requirements.
• Familiarity with GRC and compliance automation tooling (for example, Vanta or comparable platforms), AI tools to generate automated workflows and deliverables, and Lucid or Visio to produce and maintain system diagrams.
• Experience designing evidence collection and validation architecture that turns data and signals from CSPM, IAM, SIEM, CI/CD, and vulnerability scanning tools into machine readable (OSCAL) compliance evidence, and partnering with the engineers who build the automation.

Success Measures

• FedRAMP certification is achieved and maintained on schedule with no high or critical assessment findings.
• Automated continuous KSI reporting via the FedRAMP Trust Center.
• Cross-functional control owners consistently meet remediation and evidence deadlines without requiring escalation.
• Customer Trust support commitments are met on time whenever called upon.

Special Security and Privacy Requirements

This position carries special Security and Privacy Responsibilities for protecting U.S. Government interests:

• Know, acknowledge, and follow system-specific security policies and procedures;
• Protect government data and individual privacy per requirements and regulations;
• Perform ongoing activities in compliance with service and contractual obligations;
• Participate in role-based training, completing assignments on a timely basis;
• Report security issues promptly, and aid security investigations when needed;
• Support controlled changes and vulnerability remediation activities; and
• Work collaboratively in designing, implementing, assessing or enhancing system-specific security and privacy controls.

Additionally, this position requires the following:

• U.S. citizenship.

• Residency within the contiguous United States (within distance of Semperis TX, NJ offices); and

• Willingness to undergo a Single Source or similar Background Investigation if required.

Position Risk Designation:

The selected incumbent may be subject to additional background checks with periodic re-screening as noted below:

• Position Risk Designation: Non-Sensitive, Low Risk, Tier 1
• Incumbents with certain access to U.S. Government data may be required to complete Standard Form 85 and undergo a Tier 1 Investigation (T1) for non-sensitive positions of Low Risk. (Baseline screening; formerly National Agency Check and Inquiries (NACI)).

#LI-MR1

Why Join Semperis?
You’ll be part of a global team on the front lines of cybersecurity innovation. At Semperis, we celebrate curiosity, integrity, and people who take initiative. If you’re someone who sees the glass as half full, embraces challenges as growth opportunities, and values a healthy balance between work and life—we’d love to meet you.

**Semperis maintains office locations in several cities across the globe. Where the job description specifies a required location, candidates will follow our hybrid work model. This includes working up to three days per week and remotely the remaining days.

Semperis is an equal opportunity employer and will not discriminate against an applicant or employee based on race, color, religion, creed, national origin or ancestry, ethnicity, sex (including gender, pregnancy, sexual orientation, and gender identity), age, physical or mental disability, veteran or military status, genetic information, citizenship, marital status, or any other legally recognized protected basis under federal, state, or local law. The information collected by the Semperis application is solely to determine suitability for employment, verify identity, and maintain employment statistics. 

Applicants with disabilities may be entitled to reasonable accommodation under the Americans with Disabilities Act and/or other applicable state or local laws. A reasonable accommodation is a change in the way things are normally done which will ensure an equal employment opportunity without imposing undue hardship on Semperis. Please inform Semperis representative Anna Taylor, Director of Global Recruiting, if you need assistance completing this application or to otherwise participate in the application process.