Lead Program Manager - FedRAMP

Mark43 • Boston, MA

5d • Hybrid

About The Position

Mark43 is seeking a senior individual contributor to own its FedRAMP program within the Security & Compliance team. The role combines compliance, technology, and cross-functional collaboration, ensuring the program meets regulatory standards and supports broader company goals and frameworks. The position requires U.S. citizenship and is hybrid, with an expectation of working onsite once a week in the Boston, Massachusetts office. Occasional travel may be required for team collaboration or customer engagement.

The program focuses on FedRAMP Class D (High) and DoD IL4 requirements. The manager will lead continuous monitoring, maintain security documentation, coordinate assessments and evidence collection, resolve findings, and communicate compliance posture to federal stakeholders. The role also partners with Security, Engineering, and Product to translate requirements into practical guidance and assess the compliance implications of system changes. Federal controls and evidence should align with the broader GRC program, including CJIS, SOC 2, and applicable UK requirements.

Requirements

• 7+ years of experience in governance, risk, compliance, or security assurance, including substantial responsibility for federal compliance programs.
• Experience leading compliance assessments, maintaining security documentation, coordinating evidence collection, and resolving assessment findings and control gaps in a SaaS, cloud, or technology environment.
• Strong working knowledge of NIST SP 800-53, including evaluating control implementations, validating evidence, and maintaining ongoing compliance.
• Technical understanding of cloud architectures, system boundaries, inherited controls, and shared responsibilities sufficient to evaluate compliance decisions with Engineering and Security.
• Ability to translate federal requirements into practical guidance and clearly communicate compliance posture to assessors, agency stakeholders, and leadership.
• Demonstrated ability to operate autonomously, drive cross-functional commitments, and escalate risks without formal authority.
• Must be a U.S. citizen.
• Applicants must be authorized to work for any employer in the country where the role is being hired; visa sponsorship or transfer is not available.

Nice To Haves

• Direct, hands-on experience managing FedRAMP Moderate and/or High programs, including SSP maintenance, continuous monitoring, and assessment coordination.
• Experience supporting DoD IL4 and/or IL5 compliance requirements.
• Experience with AWS GovCloud, including control inheritance and shared responsibility models.
• Experience supporting federal agency authorization processes and evaluating security requirements in federal contracts.
• Experience aligning controls and evidence across federal requirements, CJIS, SOC 2, ISO 27001, or international public sector frameworks.
• Familiarity with CMMC and NIST SP 800-171.
• Humble, open, and curious; invites collaboration and is open to learning from others.
• Systems thinker who connects frameworks, environments, and priorities.
• Proactive communicator who articulates complex topics clearly and keeps stakeholders aligned.

Responsibilities

• Own Mark43’s federal compliance program end to end within GRC, focusing on FedRAMP Class D (High) and DoD IL4 requirements.
• Lead continuous monitoring, SSP maintenance, evidence collection, and required compliance reporting.
• Lead assessment planning and execution, coordinating with independent assessors, agency authorizing officials, and internal control owners.
• Coordinate resolution of assessment findings and control gaps, tracking owners, deadlines, and closure evidence.
• Partner with Security, Engineering, and Product to translate federal requirements into practical guidance and assess the compliance impact of architectural changes, features, and integrations.
• Work with technical owners to resolve gaps in system boundaries, inherited controls, and shared responsibilities across AWS GovCloud, Mark43 services, and third-party dependencies.
• Communicate compliance posture and customer responsibilities to federal stakeholders, and evaluate security requirements for prospective contracts.
• Align federal controls and evidence with the broader GRC program, including CJIS, SOC 2, and applicable UK requirements.
• Report program health, risks, and readiness to GRC leadership, and incorporate evolving federal requirements into program priorities.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed