FedRAMP Information System Security Officer (ISSO)

Semperis•Addison, TX

2d•Hybrid

About The Position

Semperis is hiring a hands-on, highly technical Governance, Risk, and Compliance professional to lead and execute day-to-day FedRAMP operational work. As the designated ISSO and the company’s day-to-day FedRAMP 20x subject matter expert, this person will define and document the certification boundary, specify and deploy mandatory Key Security Indicators (KSIs), and deliver the automated evidence pipeline, FedRAMP Trust Center, and Security Inbox required for FedRAMP 20x. The role guides Semperis’s interpretation of FedRAMP requirements and explains implementation details to company leadership, Security Assessors, and FedRAMP reviewers. The ISSO reports to the Head of Risk and Compliance, who serves as the FedRAMP Information System Security Manager (ISSM). The role works closely with Security Engineering, Product and Engineering leadership, and Sales Government Solutions. It may also support other GRC and Trust initiatives and certifications as needed to advance Semperis’s capabilities. The position follows a hybrid work model at one of the listed offices: Hoboken, New Jersey; Addison, Texas; Phoenix, Arizona; or Austin, Texas. The hybrid model includes working up to three days per week in the office and remotely the remaining days. Applicants must be U.S. citizens and reside within the contiguous United States within distance of Semperis’s Texas or New Jersey offices. The selected incumbent may be subject to additional background checks and periodic rescreening; a Tier 1 investigation may be required for access to U.S. Government data.

Requirements

At least 6 years of experience in GRC, information security compliance, or IT audit, including hands-on FedRAMP ISSO experience through at least one full Rev 5 authorization at a SaaS or cloud software company.
At least one of the following certifications: CRISC, CISM, CISA, CISSP, or an equivalent recognized security, risk, or audit management credential.
Direct experience implementing NIST SP 800-53 controls within a FedRAMP authorization; candidates with one full authorization are also expected to have some FedRAMP 20x exposure.
Working fluency across cloud platforms such as Azure and AWS and platform security domains including IAM, encryption, vulnerability management, SIEM, and cloud configuration.
Ability to work independently as an individual contributor, own deliverables, set priorities, and know when to act independently or bring an issue to the ISSM.
A strong track record of managing by influence and driving engineers, product managers, and other non-reporting stakeholders to deliver evidence, remediate findings, and meet audit deadlines.
Direct experience managing external auditors, assessors, or certification bodies through full audit cycles.
U.S. citizenship.
Residency within the contiguous United States and within distance of Semperis’s Texas or New Jersey offices.
Willingness to undergo a Single Source or similar Background Investigation if required.

Nice To Haves

Experience with or exposure to FedRAMP 20x KSIs and familiarity with higher-tier FedRAMP Moderate and High certifications.
Experience with related frameworks and requirements, including DoD Impact Levels, GovRAMP/StateRAMP, CMMC, NIST 800-171, and CUI handling.
Familiarity with GRC and compliance automation tools such as Vanta or comparable platforms, AI tools for generating automated workflows and deliverables, and Lucid or Visio for creating and maintaining system diagrams.
Experience designing evidence collection and validation architecture that converts CSPM, IAM, SIEM, CI/CD, and vulnerability-scanning signals into machine-readable (OSCAL) compliance evidence, and partnering with engineers who build the automation.

Responsibilities

Mobilize the FedRAMP 20x program for in-scope products by guiding the project charter, establishing governance and reporting cadence, developing stakeholder RACI, and planning work with project management.
Work with the FedRAMP ISSM to propose staffing for required FedRAMP roles.
Deliver a signed charter and published work plan tracked against internal planning gates, ensuring every workstream has an owner.
Establish requirements for expanded use of the GRC system for the Trust Center, controls mapping, evidence collection, OSCAL outputs, and risk management.
Document the Cloud Service Offering for 20x certification, including its production environment, data plane and data flows, management plane, security controls plane, and in-scope supporting services; reconcile the proposed boundary against the latest SOC 2 scope as applicable.
Complete gap assessments and build the capability to deliver mandatory 20x KSIs, with a defined measure, authoritative evidence source, accountable owner, and documented “Meets” status for each.
Design and build the FedRAMP Trust Center, Security Inbox, and machine-readable KSI evidence pipeline, normalizing signals from CSPM, IAM, SIEM, CI/CD, and vulnerability-scanning tools.
Partner with Product, Engineering, and Security leadership to embed FedRAMP controls into the SDLC and cloud infrastructure design, define control requirements, validate designs, and set testable success criteria for compliance-as-code workstreams.
Deliver the FedRAMP Marketplace listing and full 20x Certification Package, and take it through the FedRAMP PMO review process to certification.
Operationalize post-certification maintenance, including recurring KSI reviews, POA&M-style remediation tracking, and required ongoing FedRAMP reporting.
Assess the security impact of proposed changes and prepare significant-change submissions for the ISSM’s sign-off.
Procure or develop annual and role-based training required by FedRAMP, and manage associated records and compliance activities.
Ensure required non-technical controls are implemented and manage day-to-day 3PAO, advisory, and accelerator vendor relationships as the program advances beyond Class A.
Drive timely remediation of risks and control gaps found through audits, vulnerability scans, and penetration tests; translate technical findings into business-risk context; bring risk-acceptance proposals to the ISSM; and escalate high-risk blockers to the Head of Risk and Compliance and/or CISO.
Define and track program KSIs and KPIs and support the Head of Risk and Compliance on related KRIs.
Support certifications on the roadmap, such as GovRAMP, HIPAA, and CJIS, and lead assigned workstreams.
Build data-backed analysis to recommend whether and when to pursue higher-level certifications, including Year 1 pipeline, conversion, and demand-signal data and staffing, GovCloud, and cost implications, in time for executive and board budget planning.
Safeguard the confidentiality, integrity, and availability of federal information and systems within the authorization boundary, protect against unauthorized access, use, disclosure, or misuse, and report such instances through required channels.
Comply with and help enforce personnel-security policies, procedures, and acceptable-use and rules-of-behavior requirements for personnel in trusted roles.
Promptly report insider-threat indicators and security or suitability concerns through designated channels and support insider-threat program requirements.
Document and report security incidents within required timeframes.
Support internal and external security assessments, audits, and agency reviews.
Know, acknowledge, and follow system-specific security policies and procedures; protect government data and individual privacy; perform work in compliance with service and contractual obligations; participate in role-based training; report security issues and assist investigations; support controlled changes and vulnerability remediation; and collaborate on system-specific security and privacy controls.