FedRAMP Information System Security Officer (ISSO)

The designated Information System Security Officer (ISSO) will lead and execute day-to-day FedRAMP operational work at Semperis, define and document the certification boundary, specify and deploy the mandatory Key Security Indicators (KSIs), and deliver the automated evidence pipeline, FedRAMP Trust Center, and Security Inbox that FedRAMP 20x requires. The role is a hands-on, highly technical GRC role reporting to the Head of Risk and Compliance, who serves as the FedRAMP Information System Security Manager (ISSM). Position Risk Designation: Non-Sensitive, Low Risk, Tier 1.

Responsibilities

Mobilize the FedRAMP 20x Program for in-scope products: guide the project charter, establish governance and reporting cadence, develop the stakeholder RACI, and outline a work plan; Work with the FedRAMP ISSM to propose staffing of required FedRAMP roles; Deliver a signed charter and a published work plan; Establish requirements for expanded use of the GRC system; Document the Cloud Service Offering (CSO) for 20x certification and reconcile the boundary against the most recent SOC 2 report's scope; Complete gap assessments and build capability to deliver all mandatory 20x KSIs; Design and build the FedRAMP Trust Center, Security Inbox, and machine-readable KSI evidence pipeline; Embed FedRAMP controls into the SDLC and cloud infrastructure design; Deliver the FedRAMP Marketplace listing and the 20x Certification Package through the FedRAMP PMO review process; Operationalize post-certification maintenance, recurring KSI reviews, POA&M-style remediation tracking, and ongoing FedRAMP reporting; Procure or develop annual and role-based training and manage related records; Ensure implementation of non-technical controls and manage 3PAO, advisory, and accelerator vendor relationships; Drive remediation of risks and control gaps from audits, vulnerability scans, and penetration tests; Define and track KSIs and KPIs for the program and support KRIs; Support other certifications such as GovRAMP, HIPAA, and CJIS; Build data-backed analysis on pursuing higher-level certifications; Safeguard confidentiality, integrity, and availability of federal information and systems within the authorization boundary; Report security incidents, insider-threat indicators, and unauthorized access within required timeframes; Support internal and external security assessments, audits, and agency reviews

Requirements

6+ years of experience in GRC, information security compliance, or IT audit, including hands-on FedRAMP ISSO experience through at least one full Rev 5 authorization (typically about 3 years) at a SaaS or cloud software company; At least one of the following certifications: CRISC, CISM, CISA, CISSP, or an equivalent recognized security, risk, or audit management credential; Direct implementation of NIST SP 800-53 controls within a FedRAMP authorization; Working fluency across cloud (Azure, AWS) and platform security domains: IAM, encryption, vulnerability management, SIEM, and cloud configuration; Ability to work independently as an individual contributor; Strong "manage by influence" track record; Direct experience managing external auditors, assessors, or certification bodies through full audit cycles; U.S. citizenship; Residency within the contiguous United States (within distance of Semperis TX, NJ offices); Willingness to undergo a Single Source or similar Background Investigation if required

Nice to have

Experience with or exposure to FedRAMP 20x KSIs (not just Rev 5 process); Familiarity with higher-tier FedRAMP certifications (Moderate and High); Experience with related frameworks: DoD Impact Levels, GovRAMP/StateRAMP, CMMC, NIST 800-171, and CUI handling requirements; Familiarity with GRC and compliance automation tooling (for example, Vanta or comparable platforms), AI tools, and Lucid or Visio; Experience designing evidence collection and validation architecture that turns CSPM, IAM, SIEM, CI/CD, and vulnerability scanning signals into machine readable (OSCAL) compliance evidence