FedRAMP ISSM & Security Compliance Lead

Merlin International Inc; McLean (VA); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

On-site gym

Medical, dental, and vision insurance

401(k) with employer match

Unlimited PTO

Job summary

Merlin International Inc. is seeking an Information System Security Manager (ISSM) to own day‑to‑day security compliance and continuous monitoring, maintaining FedRAMP authorization.

You will coordinate access, vulnerability scanning, POA&M, change control, and the compliance calendar, while communicating security requirements clearly to customers and leadership. Based in McLean, VA, this full‑time role emphasizes collaboration with engineering and SOC teams to translate controls into actionable

Qualifications

• 5+ years as ISSM in FedRAMP authorized environments.
• Direct experience with FedRAMP Rev 5, 20x, CR26 requirements.
• Hands-on vulnerability management and POA&M processes.

Responsibilities

• Coordinate access authorization and quarterly reviews.
• Maintain POA&M with owners, dates, and remediation.
• Perform vulnerability scanning and reporting to stakeholders.
• Manage Change Control Board and Security Impact Assessments.
• Coordinate major changes through review and approval processes.
• Track the recurring compliance calendar (IRCP, ROB, contingency tests).
• Coordinate SBOM submissions and LMS security training.

Skills

FedRAMP Rev 5

CSP experience

Vulnerability management

POA&M processes

Change control

SBOM coordination

LMS security training

Risk reporting

Project management

Clear communication

Tools

LMS

Job description

Merlin International Inc. is seeking an Information System Security Manager (ISSM) to own day‑to‑day security compliance and continuous monitoring, maintaining FedRAMP authorization.

You will coordinate access, vulnerability scanning, POA&M, change control, and the compliance calendar, while communicating security requirements clearly to customers and leadership. Based in McLean, VA, this full‑time role emphasizes collaboration with engineering and SOC teams to translate controls into actionable