Building Maintenance and Operations Specialist

MEDITECH; Canton (MA); On-site; USD 110,000 - 150,000; Full time

Job summary

MEDITECH, a leading health IT provider, is seeking a Government Compliance Program Manager in Canton, MA to lead FedRAMP/ITSG-33 readiness, maintain NIST-based controls, and align cloud operations with regulatory standards.

You will author SSPs, SCTMs, POA&Ms; coordinate audits; work with Cloud/DevOps; ensure timely remediation; report to security leadership; require 3+ years in info security and relevant certifications.

Qualifications

• 3+ years in Information Security, IT Compliance, or GRC.
• Hands-on FedRAMP or ITSG-33 experience.
• Practical understanding of NIST SP 800-53 in cloud.
• Experience writing SSPs, POA&Ms, and incident plans.
• Strong written communication for regulatory language.
• Able to coordinate audits with 3PAOs and teams.

Responsibilities

• Author/maintain SSPs, SCTMs, and policy docs.
• Map controls to NIST SP 800-53 and CCCS profiles.
• Track evidence for identity, access, encryption, monitoring.
• Coordinate day-to-day during third-party assessments.
• Manage POA&M register and remediation tracking.
• Collect audit evidence for smooth assessment lifecycles.
• Support Continuous Monitoring program and monthly reviews.

Skills

FedRAMP

ITSG-33

NIST 800-53

Cloud IAM

FIPS Encryption

Vulnerability Mgmt

SSP/POAM Writing

Audits

Policy Mapping

Certifications

Tools

AWS GovCloud

Azure Government

GCP

SIEM

POA&M tooling

Job description

Government Compliance Program Manager

Full-time

Canton, MA Cloud Services & Technology

Description

As a Government Compliance Program Manager, you will be heavily involved in preparing our SaaS product and cloud operations for ITSG-33 and FedRAMP authorizations, as well as maintaining our broader data protection and privacy standards. Working under the direction of security leadership, you will serve as the operational bridge between technical teams and regulatory frameworks—writing security documentation, mapping control implementations, tracking remediation items, and facilitating auditor requests. As a member of our Cloud Services team, your job would involve:

• Authoring, updating, and maintaining core government compliance packages, including System Security Plans (SSPs), Security Control Traceability Matrices (SCTMs), and supporting policy documents
• Mapping operational controls across NIST SP 800-53 and CCCS Medium Cloud Profile to ensure clear alignment with engineering and IT workflows
• Tracking control coverage and document evidence for identity management, access control, encryption standards, and monitoring routines
• Coordinating day-to-day operations during third-party assessment (3PAOs) and government audits
• Managing and updating the Plan of Action and Milestones (POA&M) register - working directly with Cloud/DevOps and Engineering teams to ensure timely remediation of vulnerabilities and findings
• Collecting, organizing, and validating audit evidence to ensure smooth assessment lifecycles
• Supporting the execution of the Continuous Monitoring program, including organizing monthly scan reviews, vulnerability logs, and quarterly deliverable packages
• Assisting in conducting internal assessments, vendor risk evaluations, and data protection reviews for GDP/privacy compliance
• Monitoring updates to federal standards (NIST, CCCS) and highlighting necessary operational updates to security leadership.

Requirements

• Experience: 3+ years in Information Security, IT Compliance, or GRC, with direct experience participating in FedRAMP or ITSG-33 Protected B compliance efforts
• Framework Knowledge: Practical understanding of NIST SP 800-53 controls and how they are implemented within cloud infrastructure (AWS GovCloud, Azure Government, or GCP)
• Familiarity with general cloud architecture concepts, IAM, FIPS-compliant encryption, SIEM/logging platforms, and vulnerability management tools
• Hands-on Artifact Creation: Demonstrated experience writing or maintaining compliance artifacts (SSPs, POA&M, Incident Response Plans)
• Project Tracking: Strong organizational skills with experience tracking complex cross-functional deliverables across software and IT teams
• Strong written communication skills - able to clearly explain technical controls in formal regulatory language
• Collaborating effectively with software engineers, system admins, and external auditors
• Certifications: CISA, CRISC, CISM, CAP/CGRC, or Security+ preferred
• Clearance Eligibility: Ability to obtain or hold government security screening (e.g., PSPC Reliability/Secret in Canada, or US equivalent) is a strong plus.