FedRAMP Information System Security Officer (ISSO)

As the designated Information System Security Officer (ISSO), you will lead and execute day-to-day FedRAMP operational work at Semperis. Your role will define and document the certification boundary, specify and deploy the mandatory Key Security Indicators (KSIs), and deliver the automated evidence pipeline, FedRAMP Trust Center, and Security Inbox that FedRAMP 20x requires. The role reports to the Head of Risk and Compliance, who serves as the FedRAMP Information System Security Manager (ISSM).

Responsibilities

Mobilize the FedRAMP 20x Program for in-scope products, including project charter, governance, reporting cadence, stakeholder RACI, and work plan; Work with the FedRAMP ISSM to propose staffing of required FedRAMP roles; Deliver a signed charter and published work plan tracked against internal planning gates; Establish requirements for expanded use of the GRC system for Trust Center, controls mapping, evidence collection, OSCAL outputs, and risk management; Document the Cloud Service Offering (CSO) for 20x certification and reconcile the FedRAMP boundary against the most recent SOC 2 scope; Complete gap assessments and build capability to deliver all mandatory 20x KSIs with defined measures, evidence sources, owners, and documented "Meets" status; Design and build the FedRAMP Trust Center, Security Inbox, and machine-readable KSI evidence pipeline; Embed FedRAMP controls into the SDLC and cloud infrastructure design, including "compliance as code" workstreams; Deliver the FedRAMP Marketplace listing and full 20x Certification Package through the FedRAMP PMO review process; Operationalize post-certification maintenance, including recurring KSI reviews, POA&M-style remediation tracking, and ongoing FedRAMP reporting; Procure or develop and deliver annual and role-based training and manage related records; Ensure implementation of required non-technical controls and manage 3PAO, advisory, and accelerator vendor relationships; Drive remediation of risks and control gaps from audits, vulnerability scans, and penetration tests; Define and track KSIs and KPIs for the program and support KRIs; Support other certifications such as GovRAMP, HIPAA, and CJIS and lead assigned workstreams; Build data-backed analysis on pursuing higher-level certifications; Safeguard confidentiality, integrity, and availability of federal information and systems within the authorization boundary; Report security incidents, unauthorized access, and insider-threat indicators within required timeframes; Support internal and external security assessments, audits, and agency reviews

Requirements

6+ years of experience in GRC, information security compliance, or IT audit, including hands-on FedRAMP ISSO experience through at least one full Rev 5 authorization (typically about 3 years) at a SaaS or cloud software company; At least one of the following certifications: CRISC, CISM, CISA, CISSP, or an equivalent recognized security, risk, or audit management credential; Direct implementation of NIST SP 800-53 controls within a FedRAMP authorization; Some FedRAMP 20x exposure expected if one full authorization is held; Working fluency across cloud (Azure, AWS) and platform security domains: IAM, encryption, vulnerability management, SIEM, and cloud configuration; Ability to work independently as an individual contributor; Strong "manage by influence" track record; Direct experience managing external auditors, assessors, or certification bodies through full audit cycles; U.S. citizenship; Residency within the contiguous United States (within distance of Semperis TX, NJ offices); Willingness to undergo a Single Source or similar Background Investigation if required

Nice to have

Experience with or exposure to FedRAMP 20x KSIs (not just Rev 5 process); Familiarity with higher-tier FedRAMP certifications (Moderate and High); Experience with related frameworks: DoD Impact Levels, GovRAMP/StateRAMP, CMMC, NIST 800-171, and CUI handling requirements; Familiarity with GRC and compliance automation tooling (for example, Vanta or comparable platforms), AI tools for automated workflows and deliverables, and Lucid or Visio for system diagrams; Experience designing evidence collection and validation architecture turning CSPM, IAM, SIEM, CI/CD, and vulnerability scanning data into machine-readable (OSCAL) compliance evidence