FedRAMP Information System Security Officer (ISSO)

The role

You will lead and execute day-to-day FedRAMP operational work. You will define certification boundaries, deploy Key Security Indicators, and deliver automated evidence pipelines.

What you will do

• Mobilize the FedRAMP 20x Program for in-scope products
• Document the Cloud Service Offering for 20x certification
• Complete gap assessments and build capability to deliver mandatory 20x KSIs
• Design and build the FedRAMP Trust Center and Security Inbox
• Partner with Product, Engineering, and Security leadership to embed FedRAMP controls into the SDLC
• Deliver the FedRAMP Marketplace listing and full 20x Certification Package
• Operationalize the post-certification maintenance program
• Procure or develop and deliver annual and role-based training
• Manage 3PAO, advisory, and accelerator vendor relationships
• Drive timely remediation of risks and control gaps

Required qualifications

• 6+ years of experience in GRC, information security compliance, or IT audit
• Hands-on FedRAMP ISSO experience through at least one full Rev 5 authorization
• CRISC, CISM, CISA, CISSP, or an equivalent recognized security, risk, or audit management credential
• Direct implementation of NIST SP 800-53 controls within a FedRAMP authorization
• Working fluency across cloud (Azure, AWS) and platform security domains: IAM, encryption, vulnerability management, SIEM, and cloud configuration
• Ability to work independently as an individual contributor
• Experience driving engineers, product managers, and other non-reporting stakeholders to deliver evidence and meet audit deadlines
• Direct experience managing external auditors, assessors, or certification bodies through full audit cycles
• U.S. citizenship
• Residency within the contiguous United States (within distance of Semperis TX, NJ offices)

Nice to have

• Experience with or exposure to FedRAMP 20x KSIs
• Familiarity with higher-tier FedRAMP certifications (Moderate and High)
• Experience with related frameworks: DoD Impact Levels, GovRAMP/StateRAMP, CMMC, NIST 800-171, and CUI handling requirements
• Familiarity with GRC and compliance automation tooling (for example, Vanta or comparable platforms)
• Use of AI tools to generate automated workflows and deliverables
• Use of Lucid or Visio to produce and maintain system diagrams
• Experience designing evidence collection and validation architecture using OSCAL

Benefits

• Employee experience rooted in purpose, growth, and balance

Before you apply

• U.S. citizenship required
• Residency within the contiguous United States required
• Willingness to undergo a Single Source or similar Background Investigation if required

About the company

Semperis is a cybersecurity company recognized as one of America’s Fastest-Growing Cybersecurity Companies by the Inc. 5000. Their mission is to be a Force for Good.