FedRAMP Information System Security Officer (ISSO)
Semperis · Dallas, Texas, United States · hybrid
At Semperis, our mission is to be a Force for Good. Starting with being a great place to work. We believe that when people feel valued, supported, and empowered, they do their best work. That’s why we focus on creating an employee experience rooted in purpose, growth, and balance. Semperis has been recognized as one of America’s Fastest-Growing Cybersecurity Companies by the Inc. 5000, a DUNS 100 Top Startup to Work For, and a multi-year Inc. Best Workplace awardee.
Location: Hybrid In-Office: Hoboken, NJ; Addison, TX; Phoenix, AZ; or Austin, TX
ABOUT THE ROLE
We protect some of the world's largest, most complex hybrid identity environments, and that mission depends on earning and keeping our customers' trust. Our GRC team is the engine behind that trust, running the certification and audit programs that let security-conscious enterprises, regulated industries, and government customers confidently adopt our cloud products.
As the designated Information System Security Officer (ISSO), you will lead and execute day-to-day FedRAMP operational work at Semperis. Your role will define and document the certification boundary, specify and deploy the mandatory Key Security Indicators (KSIs), and deliver the automated evidence pipeline, FedRAMP Trust Center, and Security Inbox that FedRAMP 20x requires.
This is a hands-on, highly technical GRC role for someone who can guide how Semperis meets FedRAMP requirements and get into the details of continuous assurance automation. You will guide Semperis’s interpretation of each FedRAMP requirement and outline the implementation details directly to Semperis leadership, Security Assessors, and FedRAMP reviewers.
The role reports to the Head of Risk and Compliance, who serves as the FedRAMP Information System Security Manager (ISSM). You will work very closely with Security Engineering, Product/Engineering leadership, and Sales Government Solutions, and will be relied upon as the company’s day-to-day FedRAMP 20x subject matter expert.
In addition to FedRAMP responsibilities, you may support other Governance, Risk, Compliance, and Trust initiatives and certifications as needed to advance and mature Semperis’s GRC capabilities.
What you Will Do
FedRAMP Certification & Governance
- Mobilize the FedRAMP 20x Program for in-scope product(s): guide the project charter, establish governance and reporting cadence, develop the stakeholder RACI, and work with project management to outline a viable work plan.
- Work with the FedRAMP ISSM to propose staffing of required FedRAMP roles for the certification project.
- Deliver a signed charter and a published work plan tracked against internal planning gates (executive go-decision, security engineering work, listing-readiness) so that no workstream is unowned.
- Establish the requirements for expanded use of our GRC system for Trust Center, controls mapping, evidence collection, OSCAL outputs, and associated risk management needs.
FedRAMP Certification & Continuous Compliance
- Document the Cloud Service Offering (CSO) for 20x certification, including the production environment, data plane and data flows, management plane, security controls plane, and in-scope supporting services. As applicable, reconcile the proposed FedRAMP boundary against the most recent SOC 2 report’s scope.
- Complete gap assessment(s) and build capability to deliver all mandatory 20x KSIs, ensuring each has a correctly defined measure, an authoritative evidence source, an accountable owner, and a documented “Meets” status.
- Design and build the FedRAMP Trust Center, Security Inbox, and a machine-readable KSI evidence pipeline, normalizing signals from CSPM, IAM, SIEM, CI/CD, and vulnerability-scanning tools so certification data is generated from live systems rather than manually assembled spreadsheets.
- Partner with Product, Engineering, and Security leadership to embed FedRAMP controls directly into the SDLC and cloud infrastructure design, establishing control requirements, validating designs, and setting testable success criteria for “compliance as code” workstreams.
- Deliver the FedRAMP Marketplace listing and the full 20x Certification Package, carrying it through the FedRAMP PMO’s review process to FedRAMP certification.
- Operationalize the post-certification maintenance program: recurring KSI reviews, POA&M-style remediation tracking, and the required ongoing reporting cycle to FedRAMP (certification data changes, accepted vulnerabilities, transformative changes, agencies using the service, reportable incidents). Assess the security impact of proposed changes and prepare significant change submissions for the ISSM’s sign off.
- Procure or develop and deliver annual and role-based training in accordance with FedRAMP requirements and manage the associated records and compliance activities.
- Ensure implementation of all required non-technical controls, and manage day to day 3PAO, advisory, and accelerator vendor relationships as the program moves beyond Class A.
- Drive timely remediation of risks and control gaps surfaced through audits, vulnerability scans, and penetration tests; translate technical findings into business-risk context for internal executives and (where applicable) external parties; bring risk acceptance proposals to the ISSM; escalate high-risk blockers to the Head of Risk and Compliance and/or CISO.
- Define and track Key Security Indicators (KSIs) and Key Performance Indicators (KPIs) for the program, and support the Head of Risk and Compliance on related Key Risk Indicators (KRIs).
- Support other certifications on the roadmap, such as GovRAMP, HIPAA, and CJIS, and lead the workstreams assigned to you.
- Build the data-backed analysis behind the recommendation on whether and when to pursue higher level certification(s), grounded in Year 1 pipeline, conversion, and demand-signal data, including staffing, GovCloud, and cost implications, delivered in time to inform executive and board budget planning.
Security, Privacy and Reporting Responsibilities
- Safeguard the confidentiality, integrity, and availability of federal information and systems within the authorization boundary and protect from unauthorized access, use, disclosure, or misuse; report any instance of unauthorized access, use, or misuse through required channels.
- Comply with and help enforce personnel-security policies and procedures and acceptable-use/rules-of-behavior requirements for personnel in trusted roles.
- Report insider-threat indicators and security/suitability concerns promptly through designated channels; support insider-threat program requirements.
- Document and report security incidents within required timeframes.
- Support internal and external security assessments, audits, and agency reviews
What You Will Bring (Required)
- 6+ years of experience in GRC, information security compliance, or IT audit, including hands-on FedRAMP ISSO experience through at least one full Rev 5 authorization (typically about 3 years) at a SaaS or cloud software company.
- At least one of the following certifications: CRISC, CISM, CISA, CISSP, or an equivalent recognized security, risk, or audit management credential.
- Direct implementation of NIST SP 800-53 controls within a FedRAMP authorization. If you have one full authorization behind you, some FedRAMP 20x exposure is also expected.
- Working fluency across cloud (Azure, AWS) and platform security domains: IAM, encryption, vulnerability management, SIEM, and cloud configuration.
- Ability to work independently as an individual contributor: owning your deliverables, setting priorities for your workstreams, and knowing when to act on your own and when to bring an issue to the ISSM.
- Strong "manage by influence" track record: experience driving engineers, product managers, and other non-reporting stakeholders to deliver evidence, remediate findings, and meet audit deadlines.
- Direct experi