FedRAMP Information System Security Officer (ISSO)

Semperis•Austin, TX

2d•Hybrid

About The Position

Semperis is hiring a hands-on, highly technical GRC professional to lead and execute day-to-day FedRAMP operational work. The designated ISSO will guide how Semperis interprets and implements FedRAMP requirements, explain implementation details to company leadership, Security Assessors, and FedRAMP reviewers, and serve as the company’s day-to-day FedRAMP 20x subject matter expert. The role reports to the Head of Risk and Compliance, who serves as the FedRAMP Information System Security Manager (ISSM), and works closely with Security Engineering, Product and Engineering leadership, and Sales Government Solutions. The ISSO will mobilize the FedRAMP 20x program, document the Cloud Service Offering and certification boundary, assess gaps, and implement mandatory Key Security Indicators (KSIs). The role will design and deliver the FedRAMP Trust Center, Security Inbox, and automated, machine-readable evidence pipeline using signals from security and cloud tools. It will also embed FedRAMP controls into product development and cloud infrastructure, complete the certification package and Marketplace listing, guide the package through review to certification, and operationalize continuous compliance and post-certification reporting. The position also includes vendor and assessor relationship management, risk and remediation tracking, required personnel training, and support for other GRC initiatives and certifications such as GovRAMP, HIPAA, and CJIS. The role carries special security and privacy responsibilities for protecting federal information and systems. Applicants must be U.S. citizens, reside within the contiguous United States within distance of Semperis’s TX or NJ offices, and be willing to undergo a Single Source or similar background investigation if required. The role is hybrid at the Hoboken, NJ; Addison, TX; Phoenix, AZ; or Austin, TX office, with up to three days per week in office and the remainder remote.

Requirements

At least 6 years of experience in GRC, information security compliance, or IT audit, including hands-on FedRAMP ISSO experience through at least one full Rev 5 authorization at a SaaS or cloud software company.
At least one certification: CRISC, CISM, CISA, CISSP, or an equivalent recognized security, risk, or audit management credential.
Direct experience implementing NIST SP 800-53 controls within a FedRAMP authorization.
If the candidate has completed one full authorization, some FedRAMP 20x exposure is expected.
Working fluency across cloud platforms such as Azure and AWS and security domains including IAM, encryption, vulnerability management, SIEM, and cloud configuration.
Ability to work independently as an individual contributor, own deliverables, prioritize workstreams, and know when to act independently or raise issues to the ISSM.
Demonstrated ability to manage by influence and drive engineers, product managers, and other non-reporting stakeholders to deliver evidence, remediate findings, and meet audit deadlines.
Direct experience managing external auditors, assessors, or certification bodies through full audit cycles.
U.S. citizenship.
Residency within the contiguous United States within distance of Semperis TX or NJ offices.
Willingness to undergo a Single Source or similar Background Investigation if required.
Ability to meet special security and privacy responsibilities, including protecting government information, completing required training, reporting security issues, supporting investigations, and complying with system-specific policies and contractual obligations.

Nice To Haves

Experience with or exposure to FedRAMP 20x KSIs beyond the Rev 5 process and familiarity with higher-tier FedRAMP certifications, including Moderate and High.
Experience with DoD Impact Levels, GovRAMP/StateRAMP, CMMC, NIST 800-171, and CUI handling requirements.
Familiarity with GRC and compliance automation platforms such as Vanta or comparable tools, AI tools for automated workflows and deliverables, and Lucid or Visio for system diagrams.
Experience designing evidence collection and validation architecture that converts CSPM, IAM, SIEM, CI/CD, and vulnerability-scanning signals into machine-readable OSCAL compliance evidence, and partnering with engineers building the automation.

Responsibilities

Mobilize the FedRAMP 20x program for in-scope products by developing the project charter, governance and reporting cadence, stakeholder RACI, and work plan with project management.
Work with the FedRAMP ISSM to propose staffing for required FedRAMP roles and deliver a signed charter and published work plan tracked against internal planning gates.
Establish requirements for expanded use of the GRC system for the Trust Center, control mapping, evidence collection, OSCAL outputs, and risk management.
Document the Cloud Service Offering and certification boundary, including production environment, data plane and flows, management plane, security controls plane, and supporting services; reconcile the boundary with the latest SOC 2 scope where applicable.
Complete gap assessments and establish the capabilities needed to deliver mandatory 20x KSIs, with defined measures, authoritative evidence sources, accountable owners, and documented status.
Design and build the FedRAMP Trust Center, Security Inbox, and machine-readable KSI evidence pipeline, integrating signals from CSPM, IAM, SIEM, CI/CD, and vulnerability-scanning tools.
Partner with Product, Engineering, and Security leadership to embed FedRAMP controls into the SDLC and cloud infrastructure, define control requirements, validate designs, and establish testable success criteria for compliance-as-code workstreams.
Deliver the FedRAMP Marketplace listing and full 20x Certification Package, and guide it through the FedRAMP PMO review process to certification.
Operationalize post-certification maintenance, including recurring KSI reviews, POA&M-style remediation tracking, and required reporting to FedRAMP.
Assess the security impact of proposed changes and prepare significant-change submissions for ISSM sign-off.
Procure or develop and deliver annual and role-based training required by FedRAMP, and manage related records and compliance activities.
Implement required non-technical controls and manage day-to-day 3PAO, advisory, and accelerator vendor relationships as the program progresses beyond Class A.
Drive timely remediation of risks and control gaps identified through audits, vulnerability scans, and penetration tests; translate technical findings into business-risk context, bring risk-acceptance proposals to the ISSM, and escalate high-risk blockers to the Head of Risk and Compliance and/or CISO.
Define and track program KSIs and KPIs and support the Head of Risk and Compliance with related KRIs.
Support other roadmap certifications, including GovRAMP, HIPAA, and CJIS, and lead assigned workstreams.
Develop data-backed analysis to recommend whether and when to pursue higher-level certifications, accounting for pipeline, conversion, demand signals, staffing, GovCloud, and cost implications for executive and board budget planning.
Safeguard the confidentiality, integrity, and availability of federal information and systems within the authorization boundary and report unauthorized access, use, disclosure, or misuse through required channels.
Follow and help enforce personnel-security policies, acceptable-use rules, and rules-of-behavior requirements for personnel in trusted roles.
Promptly report insider-threat indicators and security or suitability concerns through designated channels and support insider-threat program requirements.
Document and report security incidents within required timeframes.
Support internal and external security assessments, audits, and agency reviews.
Know, acknowledge, and follow system-specific security policies and procedures; protect government data and individual privacy; comply with service and contractual obligations; complete role-based training; report security issues and support investigations; support controlled changes and vulnerability remediation; and collaborate on system-specific security and privacy controls.