Senior FedRAMP Compliance Manager

Coralogix•Boston, MA

2d•$170,000 - $210,000

About The Position

Coralogix is seeking a Senior Compliance Manager to lead its FedRAMP compliance program and help advance its SaaS platform from FedRAMP Ready to Authorized. The role oversees the FedRAMP Moderate authorization audit, governs security documentation, coordinates evidence and remediation with engineering and security teams, and serves as a liaison to the sponsoring agency, FedRAMP PMO, 3PAO, advisors, and auditors. The position requires deep knowledge of NIST SP 800-53 controls and FedRAMP requirements, along with experience leading cloud-service authorizations and supporting continuous monitoring. The Senior FedRAMP Compliance Manager will assess controls against the FedRAMP Moderate baseline, manage security artifacts and audit activities, and coordinate control implementation and monitoring with DevOps and SecOps. The role also communicates risks and mitigation plans, tracks assessment findings through closure, and recommends improvements as FedRAMP requirements, NIST guidance, and security threats evolve.

Requirements

At least 5 years of experience in security compliance or risk management, or equivalent experience, including direct FedRAMP compliance experience.
In-depth knowledge of FedRAMP baseline requirements and the NIST SP 800-53 control framework; familiarity with the FedRAMP authorization process and FISMA standards.
Proven experience leading or playing a major role in a FedRAMP ATO process or security assessment, including preparation of agency audit packages and hands-on audit involvement.
Experience with cloud infrastructure and SaaS environments, particularly government cloud platforms such as AWS GovCloud or Azure Government, and implementing security controls in cloud architectures.
Knowledge of secure cloud configurations and technologies, including virtualization, containerization, encryption, and cloud network security.
At least one professional certification, such as CISSP, CISM, CGRC, CompTIA Cloud+, or another cloud/security certification.
Excellent written and verbal communication skills and ability to collaborate across functions and communicate compliance requirements to technical and non-technical stakeholders.
Strong analytical and problem-solving abilities, attention to detail, ability to work independently and manage multiple priorities and deadlines, and a proactive, self-driven approach.

Nice To Haves

Bachelor’s degree in Information Security, Computer Science, or a related field is given strong consideration.
Experience governing policy documents and presenting security findings or status to leadership.
Experience leading ATOs for cloud services and guiding engineering teams from planning through continuous monitoring.
Experience serving as liaison to the FedRAMP Agency and PMO.

Responsibilities

Oversee the FedRAMP Moderate authorization audit, conduct internal compliance reviews, and manage cross-functional efforts against project timelines and milestones.
Prepare, review, and update FedRAMP security documentation, including the SSP, POA&M, SAP/SAR, and related artifacts.
Map and analyze security controls against the FedRAMP Moderate baseline and NIST SP 800-53, identify gaps, and guide remediation and control implementation.
Assist with implementing and monitoring controls in the FedRAMP environment and coordinate continuous monitoring activities, including vulnerability scanning and patch management with DevOps and SecOps.
Coordinate with internal teams to integrate FedRAMP requirements into system design, development, and operations, and educate technical teams on controls and cloud architecture security practices.
Serve as the primary liaison with the 3PAO, sponsoring agency, FedRAMP advisors, and auditors; schedule audit activities, provide evidence, and address findings.
Coordinate POA&Ms with SecOps and drive remediation to closure within agreed timelines.
Communicate risks and mitigation plans and prepare materials for project reviews, audits, and annual assessments.
Stay current with FedRAMP requirements, NIST guidelines, and emerging security threats, and recommend improvements to security controls and processes.