FedRAMP Information System Security Officer (ISSO)

Semperis•Phoenix, AZ

2d•Hybrid

About The Position

Semperis is hiring a hands-on, highly technical GRC professional to lead and execute day-to-day FedRAMP operational work. The ISSO will define and document the certification boundary, specify and deploy mandatory Key Security Indicators (KSIs), and deliver the automated evidence pipeline, FedRAMP Trust Center, and Security Inbox required for FedRAMP 20x. The role guides Semperis’s interpretation of FedRAMP requirements and communicates implementation details to company leadership, Security Assessors, and FedRAMP reviewers. It also supports other GRC, trust, and certification initiatives as needed. The position reports to the Head of Risk and Compliance, who serves as the FedRAMP Information System Security Manager (ISSM). The ISSO works closely with Security Engineering, Product and Engineering leadership, and Sales Government Solutions, serving as the company’s day-to-day FedRAMP 20x subject matter expert. The role is hybrid, based near the Hoboken, NJ; Addison, TX; Phoenix, AZ; or Austin, TX offices, and follows a model of up to three days per week in-office and the remaining days remotely. The position carries special security and privacy responsibilities for protecting U.S. Government interests and data. Applicants must be U.S. citizens, reside within the contiguous United States within distance of Semperis’s TX or NJ offices, and be willing to undergo a Single Source or similar background investigation if required. The incumbent may also be subject to periodic screening and a Tier 1 investigation.

Requirements

At least 6 years of experience in GRC, information security compliance, or IT audit, including hands-on FedRAMP ISSO experience through at least one full Rev 5 authorization at a SaaS or cloud software company.
At least one of the following certifications: CRISC, CISM, CISA, CISSP, or an equivalent recognized security, risk, or audit management credential.
Direct experience implementing NIST SP 800-53 controls within a FedRAMP authorization; candidates with one full authorization are also expected to have some FedRAMP 20x exposure.
Working fluency across cloud platforms such as Azure and AWS and security domains including IAM, encryption, vulnerability management, SIEM, and cloud configuration.
Ability to work independently as an individual contributor, own deliverables, prioritize workstreams, and judge when to act independently or bring an issue to the ISSM.
A strong manage-by-influence track record driving engineers, product managers, and other non-reporting stakeholders to deliver evidence, remediate findings, and meet audit deadlines.
Direct experience managing external auditors, assessors, or certification bodies through full audit cycles.
U.S. citizenship.
Residency within the contiguous United States within distance of Semperis TX or NJ offices.
Willingness to undergo a Single Source or similar background investigation if required.
Ability to undergo additional background checks and periodic rescreening as applicable; certain access to U.S. Government data may require Standard Form 85 and a Tier 1 Investigation.

Nice To Haves

Experience with or exposure to FedRAMP 20x KSIs and familiarity with higher-tier FedRAMP Moderate and High certifications.
Experience with related frameworks, including DoD Impact Levels, GovRAMP/StateRAMP, CMMC, NIST 800-171, and CUI handling requirements.
Familiarity with GRC and compliance automation tools such as Vanta or comparable platforms, AI tools for generating automated workflows and deliverables, and Lucid or Visio for system diagrams.
Experience designing evidence-collection and validation architecture that converts signals from CSPM, IAM, SIEM, CI/CD, and vulnerability-scanning tools into machine-readable OSCAL compliance evidence, and partnering with engineers who build the automation.

Responsibilities

Mobilize the FedRAMP 20x program for in-scope products by guiding the project charter, establishing governance and reporting cadence, developing the stakeholder RACI, and creating a viable work plan with project management.
Work with the FedRAMP ISSM to propose staffing for required FedRAMP roles.
Deliver a signed charter and published work plan tracked against internal planning gates, including executive go-decision, security engineering work, and listing-readiness.
Define requirements for expanded use of the GRC system for Trust Center, controls mapping, evidence collection, OSCAL outputs, and risk management.
Document the Cloud Service Offering for 20x certification, including production environment, data plane and flows, management plane, security controls plane, and in-scope supporting services; reconcile the proposed boundary against the latest SOC 2 scope where applicable.
Complete gap assessments and build capabilities to deliver mandatory 20x KSIs, ensuring each has a defined measure, authoritative evidence source, accountable owner, and documented Meets status.
Design and build the FedRAMP Trust Center, Security Inbox, and machine-readable KSI evidence pipeline by normalizing signals from CSPM, IAM, SIEM, CI/CD, and vulnerability-scanning tools.
Partner with Product, Engineering, and Security leadership to embed FedRAMP controls into the SDLC and cloud infrastructure design, define control requirements, validate designs, and establish testable success criteria for compliance-as-code workstreams.
Deliver the FedRAMP Marketplace listing and full 20x Certification Package, and carry it through FedRAMP PMO review to certification.
Operationalize post-certification maintenance, including recurring KSI reviews, POA&M-style remediation tracking, and required ongoing FedRAMP reporting.
Assess the security impact of proposed changes and prepare significant-change submissions for the ISSM’s sign-off.
Procure or develop and deliver annual and role-based training in accordance with FedRAMP requirements, and manage related records and compliance activities.
Ensure required non-technical controls are implemented and manage day-to-day relationships with 3PAO, advisory, and accelerator vendors as the program moves beyond Class A.
Drive timely remediation of risks and control gaps identified through audits, vulnerability scans, and penetration tests; communicate technical findings in business-risk terms, bring risk-acceptance proposals to the ISSM, and escalate high-risk blockers to the Head of Risk and Compliance and/or CISO.
Define and track program KSIs and KPIs, and support the Head of Risk and Compliance on related KRIs.
Support certifications on the roadmap, such as GovRAMP, HIPAA, and CJIS, and lead assigned workstreams.
Develop data-backed recommendations on whether and when to pursue higher-level certifications, considering Year 1 pipeline, conversion and demand signals, staffing, GovCloud, and cost implications for executive and board budget planning.
Safeguard the confidentiality, integrity, and availability of federal information and systems within the authorization boundary; protect against unauthorized access, use, disclosure, or misuse and report such incidents through required channels.
Comply with and help enforce personnel-security policies, acceptable-use requirements, and rules of behavior for personnel in trusted roles.
Promptly report insider-threat indicators and security or suitability concerns through designated channels, and support insider-threat program requirements.
Document and report security incidents within required timeframes.
Support internal and external security assessments, audits, and agency reviews.
Know, acknowledge, and follow system-specific security policies and procedures; protect government data and individual privacy; perform activities in accordance with service and contractual obligations; complete role-based training; report security issues and support investigations; support controlled changes and vulnerability remediation; and collaborate on system-specific security and privacy controls.