About this role
At Semperis, our mission is to be a Force for Good. Starting with being a great place to work. We believe that when people feel valued, supported, and empowered, they do their best work. That’s why we focus on creating an employee experience rooted in purpose, growth, and balance. Semperis has been recognized as one of America’s Fastest-Growing Cybersecurity Companies by the Inc. 5000, a DUNS 100 Top Startup to Work For, and a multi-year Inc. Best Workplace awardee.
Location: Hybrid In-Office: Hoboken, NJ; Addison, TX; Phoenix, AZ; or Austin, TX
## About the Role
We protect some of the world's largest, most complex hybrid identity environments, and that mission depends on earning and keeping our customers' trust. Our GRC team is the engine behind that trust, running the certification and audit programs that let security-conscious enterprises, regulated industries, and government customers confidently adopt our cloud products.
As the designated Information System Security Officer (ISSO) , you will lead and execute day-to-day FedRAMP operational work at Semperis. Your role will define and document the certification boundary, specify and deploy the mandatory Key Security Indicators (KSIs), and deliver the automated evidence pipeline, FedRAMP Trust Center, and Security Inbox that FedRAMP 20x requires.
This is a hands-on, highly technical GRC role for someone who can guide how Semperis meets FedRAMP requirements and get into the details of continuous assurance automation. You will guide Semperis’s interpretation of each FedRAMP requirement and outline the implementation details directly to Semperis leadership, Security Assessors, and FedRAMP reviewers.
The role reports to the Head of Risk and Compliance, who serves as the FedRAMP Information System Security Manager (ISSM). You will work very closely with Security Engineering, Product/Engineering leadership, and Sales Government Solutions, and will be relied upon as the company’s day-to-day FedRAMP 20x subject matter expert.
In addition to FedRAMP responsibilities, you may support other Governance, Risk, Compliance, and Trust initiatives and certifications as needed to advance and mature Semperis’s GRC capabilities.
What you Will Do
FedRAMP Certification & Governance
- Mobilize the FedRAMP 20x Program for in-scope product(s): guide the project charter, establish governance and reporting cadence, develop the stakeholder RACI, and work with project management to outline a viable work plan.
- Work with the FedRAMP ISSM to propose staffing of required FedRAMP roles for the certification project.
- Deliver a signed charter and a published work plan tracked against internal planning gates (executive go-decision, security engineering work, listing-readiness) so that no workstream is unowned.
- Establish the requirements for expanded use of our GRC system for Trust Center, controls mapping, evidence collection, OSCAL outputs, and associated risk management needs.
FedRAMP Certification & Continuous Compliance
- Document the Cloud Service Offering (CSO) for 20x certification, including the production environment, data plane and data flows, management plane, security controls plane, and in-scope supporting services. As applicable, reconcile the proposed FedRAMP boundary against the most recent SOC 2 report’s scope.
- Complete gap assessment(s) and build capability to deliver all mandatory 20x KSIs, ensuring each has a correctly defined measure, an authoritative evidence source, an accountable owner, and a documented “Meets” status.
- Design and build the FedRAMP Trust Center, Security Inbox, and a machine-readable KSI evidence pipeline, normalizing signals from CSPM, IAM, SIEM, CI/CD, and vulnerability-scanning tools so certification data is generated from live systems rather than manually assembled spreadsheets.
- Partner with Product, Engineering, and Security leadership to embed FedRAMP controls directly into the SDLC and cloud infrastructure design, establishing control requirements, validating designs, and setting testable success criteria for “compliance as code” workstreams.
- Deliver the FedRAMP Marketplace listing and the full 20x Certification Package, carrying it through the FedRAMP PMO’s review process to FedRAMP certification.
- Operationalize the post-certification maintenance program: recurring KSI reviews, POA&M-style remediation tracking, and the required ongoing reporting cycle to FedRAMP (certification data changes, accepted vulnerabilities, transformative changes, agencies using the service, reportable incidents). Assess the security impact of proposed changes and prepare significant change submissions for the ISSM’s sign off.
- Procure or develop and deliver annual and role-based training in accordance with FedRAMP requirements and manage the associated records and compliance activities.
- Ensure implementation of all required non-technical controls, and manage day to day 3PAO, advisory, and accelerator vendor relationships as the program moves beyond Class A.
- Drive timely remediation of risks and control gaps surfaced through audits, vulnerability scans, and penetration tests; translate technical findings into business-risk context for internal executives and (where applicable) external parties; bring risk acceptance proposals to the ISSM; escalate high-risk blockers to the Head of Risk and Compliance and/or CISO.
- Define and track Key Security Indicators (KSIs) and Key Performance Indicators (KPIs) for the program, and support the Head of Risk and Compliance on related Key Risk Indicators (KRIs).
- Support other certifications on the roadmap, such as GovRAMP, HIPAA, and CJIS, and lead the workstreams assigned to you.
- Build the data-backed analysis behind the recommendation on whether and when to pursue higher level certification(s), grounded in Year 1 pipeline, conversion, and demand-signal data, including staffing, GovCloud, and cost implications, delivered in time to inform executive and board budget planning.
Security, Privacy and Reporting Responsibilities
- Safeguard the confidentiality, integrity, and availability of federal information and systems within the authorization boundary and protect from unauthorized access, use, disclosure, or misuse; report any instance of unauthorized access, use, or misuse through required channels.
- Comply with and help enforce personnel-security policies and procedures and acceptable-use/rules-of-behavior requirements for personnel in trusted roles.
- Report insider-threat indicators and security/suitability concerns promptly through designated channels; support insider-threat program requirements.
- Document and report security incidents within required timeframes.
- Support internal and external security assessments, audits, and agency reviews
What You Will Bring (Required)
- 6+ years of experience in GRC, information security compliance, or IT audit, including hands-on FedRAMP ISSO experience through at least one full Rev 5 authorization (typically about 3 years) at a SaaS or cloud software company.
- At least one of the following certifications: CRISC, CISM, CISA, CISSP, or an equivalent recognized security, risk, or audit management credential.
- Direct implementation of NIST SP 800-53 controls within a FedRAMP authorization. If you have one full authorization behind you, some FedRAMP 20x exposure is also expected.
- Working fluency across cloud (Azure, AWS) and platform security domains: IAM, encryption, vulnerability management, SIEM, and cloud configuration.
- Ability to work independently as an individual contributor: owning your deliverables, setting priorities for your workstreams, and knowing when to act on your own and when to bring an issue to the ISSM.
- Strong "manage by influence" track record: experience driving engineers, product managers, and other non-reporting stakeholders to deliver evidence, remediate findings, and meet audit deadlines.
- Direct experience managing external auditors, assessors, or certification bodies through full audit cycles.
Preferred Qualifications
- Experience with or exposure to FedRAMP 20x KSIs (not just Rev 5 process), and familiarity with higher-tier FedRAMP certifications (Moderate and High).
- Experience with related frameworks: DoD Impact Levels, GovRAMP/StateRAMP, CMMC, NIST 800-171, and CUI handling requirements.
- Familiarity with GRC and compliance automation tooling (for example, Vanta or comparable platforms), AI tools to generate automated workflows and deliverables, and Lucid or Visio to produce and maintain system diagrams.
- Experience designing evidence collection and validation architecture that turns data and signals from CSPM, IAM, SIEM, CI/CD, and vulnerability scanning tools into machine readable (OSCAL) compliance evidence, and partnering with the engineers who build the automation.
Success Measures
- FedRAMP certification is achieved and maintained on schedule with no high or critical assessment findings.
- Automated continuous KSI reporting via the FedRAMP Trust Center.
- Cross-functional control owners consistently meet remediation and evidence deadlines without requiring escalation.
- Customer Trust support commitments are met on time whenever called upon.
Special Security and Privacy Requirements
This position carries special Security and Privacy Responsibilities for protecting U.S. Government interests:
- Know, acknowledge, and follow system-specific security policies and procedures;
- Protect government data and individual privacy per requirements and regulations;
- Perform ongoing activities in compliance with service and contractual obligations;
- Participate in role-based training, completing assignments on a timely basis;
- Report security issues promptly, and aid security investigations when needed;
- Support controlled changes and vulnerability remediation activities; and
- Work collaboratively in designing, implementing, assessing or enhancing system-specific security and privacy controls.
Additionally, this position requires the following:
• U.S. citizenship.
• Residency within the contiguous United States (within distance of Semperis TX, NJ offices); and
• Willingness to undergo a Single Source or similar Background Investigation if required.
Position Risk Designation:
The selected incumbent may be subject to additional background checks with periodic re-screening as noted below:
- Position Risk Designation: Non-Sensitive, Low Risk, Tier 1
- Incumbents with certain access to U.S. Government data may be required to complete Standard Form 85 and undergo a Tier 1 Investigation (T1) for non-sensitive positions of Low Risk. (Baseline screening; formerly National Agency Check and Inquiries (NACI)).
#LI-MR1
Why Join Semperis?
You’ll be part of a global team on the front lines of cybersecurity innovation. At Semperis, we celebrate curiosity, integrity, and people who take initiative. If you’re someone who sees the glass as half full, embraces challenges as growth opportunities, and values a healthy balance between work and life—we’d love to meet you.
**Semperis maintains office locations in several cities across the globe. Where the job description specifies a required location, candidates will follow our hybrid work model. This includes working up to three days per week and remotely the remaining days.
Semperis is an equal opportunity employer and will not discriminate against an applicant or employee based on race, color, religion, creed, national origin or ancestry, ethnicity, sex (including gender, pregnancy, sexual orientation, and gender identity), age, physical or mental disability, veteran or military status, genetic information, citizenship, marital status, or any other legally recognized protected basis under federal, state, or local law. The information collected by the Semperis application is solely to determine suitability for employment, verify identity, and maintain employment statistics.
###