FedRAMP Information System Security Officer (ISSO)

Semperis•Hoboken, NJ

2d•Hybrid

About The Position

Semperis is hiring a hands-on, highly technical Governance, Risk, and Compliance professional to serve as the designated Information System Security Officer (ISSO) and lead day-to-day FedRAMP operational work. The role will define and document the certification boundary, specify and deploy mandatory Key Security Indicators (KSIs), and deliver the automated evidence pipeline, FedRAMP Trust Center, and Security Inbox required for FedRAMP 20x. The ISSO will guide Semperis’s interpretation of FedRAMP requirements and communicate implementation details to company leadership, Security Assessors, and FedRAMP reviewers. The role reports to the Head of Risk and Compliance, who serves as the FedRAMP Information System Security Manager (ISSM), and works closely with Security Engineering, Product and Engineering leadership, and Sales Government Solutions. The ISSO is the company’s day-to-day FedRAMP 20x subject matter expert and may also support other GRC, Trust, and certification initiatives. The position will mobilize and govern the FedRAMP 20x program; document the Cloud Service Offering and its authorization boundary; assess gaps; and build continuous compliance capabilities, including machine-readable KSI evidence drawn from live systems. It will partner with technical teams to embed controls into product development and cloud infrastructure, complete the Marketplace listing and certification package, and carry the effort through FedRAMP review and certification. After certification, the role will manage recurring reviews, remediation and reporting, assess proposed changes, and prepare significant change submissions for the ISSM’s approval. Additional work includes managing assessors and vendors, training and records, audit and incident support, remediation and risk communication, and support for related certifications and executive planning. The role is hybrid and based near one of Semperis’s offices in Hoboken, New Jersey; Addison, Texas; Phoenix, Arizona; or Austin, Texas. The company’s hybrid model involves working onsite up to three days per week and remotely the remaining days. Candidates must be U.S. citizens and reside in the contiguous United States within distance of the Semperis Texas or New Jersey offices. The selected incumbent may be subject to additional background checks and periodic rescreening; a Tier 1 investigation and Standard Form 85 may be required for access to certain U.S. Government data.

Requirements

At least 6 years of experience in GRC, information security compliance, or IT audit, including hands-on FedRAMP ISSO experience through at least one full Rev 5 authorization at a SaaS or cloud software company.
At least one recognized credential: CRISC, CISM, CISA, CISSP, or an equivalent security, risk, or audit management certification.
Direct experience implementing NIST SP 800-53 controls within a FedRAMP authorization; candidates with a full authorization are also expected to have some FedRAMP 20x exposure.
Working fluency in cloud environments such as Azure and AWS and platform security domains including IAM, encryption, vulnerability management, SIEM, and cloud configuration.
Ability to work independently as an individual contributor, own deliverables, prioritize workstreams, and judge when to act independently or bring an issue to the ISSM.
Demonstrated ability to influence engineers, product managers, and other stakeholders who do not report to the role to deliver evidence, remediate findings, and meet audit deadlines.
Direct experience managing external auditors, assessors, or certification bodies through full audit cycles.
U.S. citizenship.
Residency within the contiguous United States and within distance of Semperis Texas or New Jersey offices.
Willingness to undergo a Single Source or similar background investigation if required.
Ability to know, acknowledge, and follow system-specific security policies and procedures; protect government data and individual privacy; complete role-based training; report security issues; support investigations, controlled changes, and vulnerability remediation; and collaborate on system-specific security and privacy controls.

Nice To Haves

Experience with or exposure to FedRAMP 20x KSIs beyond the Rev 5 process and familiarity with higher-tier FedRAMP Moderate and High certifications.
Experience with related frameworks and requirements, including DoD Impact Levels, GovRAMP/StateRAMP, CMMC, NIST 800-171, and CUI handling.
Familiarity with GRC and compliance automation tools such as Vanta or comparable platforms, AI tools for generating automated workflows and deliverables, and Lucid or Visio for system diagrams.
Experience designing evidence collection and validation architectures that turn CSPM, IAM, SIEM, CI/CD, and vulnerability-scanning signals into machine-readable OSCAL compliance evidence, and partnering with engineers who build the automation.

Responsibilities

Mobilize and govern the FedRAMP 20x program for in-scope products, including developing the project charter, governance and reporting cadence, stakeholder RACI, and work plan.
Work with the FedRAMP ISSM to propose staffing for required FedRAMP roles and deliver a signed charter and published work plan tracked against internal planning gates.
Establish requirements for expanded use of the GRC system for the Trust Center, control mapping, evidence collection, OSCAL outputs, and risk management.
Document the Cloud Service Offering for 20x certification, including the production environment, data plane and data flows, management plane, security controls plane, and in-scope supporting services; reconcile the proposed boundary against the latest SOC 2 scope as applicable.
Complete gap assessments and establish the capability to deliver mandatory 20x KSIs, with defined measures, authoritative evidence sources, accountable owners, and documented Meets status.
Design and build the FedRAMP Trust Center, Security Inbox, and machine-readable KSI evidence pipeline, normalizing signals from CSPM, IAM, SIEM, CI/CD, and vulnerability-scanning tools.
Partner with Product, Engineering, and Security leadership to embed FedRAMP controls into the SDLC and cloud infrastructure, define control requirements, validate designs, and set testable success criteria for compliance-as-code workstreams.
Deliver the FedRAMP Marketplace listing and complete 20x Certification Package and guide it through FedRAMP PMO review to certification.
Operationalize post-certification maintenance, including recurring KSI reviews, POA&M-style remediation tracking, and ongoing FedRAMP reporting on certification data changes, accepted vulnerabilities, transformative changes, agencies using the service, and reportable incidents.
Assess the security impact of proposed changes and prepare significant change submissions for the ISSM’s sign-off.
Procure or develop annual and role-based training as required by FedRAMP and manage associated records and compliance activities.
Ensure required non-technical controls are implemented and manage day-to-day relationships with 3PAO, advisory, and accelerator vendors as the program moves beyond Class A.
Drive timely remediation of risks and control gaps identified through audits, vulnerability scans, and penetration tests; translate findings into business-risk context, bring risk acceptance proposals to the ISSM, and escalate high-risk blockers to the Head of Risk and Compliance and/or CISO.
Define and track program KSIs and KPIs and support the Head of Risk and Compliance on related KRIs.
Support other certifications on the roadmap, such as GovRAMP, HIPAA, and CJIS, and lead assigned workstreams.
Build data-backed recommendations on whether and when to pursue higher-level certifications, including analysis of Year 1 pipeline, conversion, demand signals, staffing, GovCloud, and cost implications for executive and board budget planning.
Safeguard the confidentiality, integrity, and availability of federal information and systems within the authorization boundary; protect against unauthorized access, use, disclosure, or misuse and report such instances through required channels.
Comply with and help enforce personnel-security policies, acceptable-use requirements, and rules of behavior for personnel in trusted roles.
Promptly report insider-threat indicators and security or suitability concerns through designated channels and support insider-threat program requirements.
Document and report security incidents within required timeframes.
Support internal and external security assessments, audits, and agency reviews.
Follow system-specific security policies and procedures; protect government data and individual privacy; perform ongoing activities in compliance with service and contractual obligations; complete role-based training; report security issues and assist investigations; support controlled changes and vulnerability remediation; and collaborate on security and privacy controls.