FedRAMP ISSM — Security Compliance Lead

Merlin Group; McLean, Northern (VA, KY); Hybrid; USD 150,000 - 185,000; Full time

Benefits offered by this job

On-site gym

Health insurance

Dental insurance

Vision insurance

401(k) with employer match

Unlimited PTO

Job summary

Merlin Group in McLean, VA is seeking an Information Systems Security Manager (ISSM) to own daily security compliance and continuous monitoring for FedRAMP authorization. You will coordinate access, vulnerability scanning, POA&M management, change control, and the compliance calendar, while clearly communicating risks to leadership.

The role emphasizes both people and process, requiring strong communication with customers, risk framing, and proactive governance across security controls and

Qualifications

• 5+ years as an ISSM in FedRAMP authorized environments.
• Hands-on knowledge of vulnerability management and POA&M processes.
• Experience translating controls into actionable items for engineering/SOC teams.
• Strong organizational discipline with a large recurring compliance calendar.
• Ability to communicate security requirements clearly to customers and stakeholders.

Responsibilities

• Coordinate access authorization and quarterly reviews.
• Maintain POA&M with status, owners, and due dates.
• Perform vulnerability scanning and report results to stakeholders.
• Manage Change Control Board and Security Impact Assessments.
• Track the recurring compliance calendar including IRCP and RB management.
• Coordinate SBOM submissions and LMS for security training.
• Monitor FedRAMP program changes and assess impact on the environment.
• Explain security requirements to customers, including high-pressure conversations.

Skills

FedRAMP knowledge

ISSM experience

Vulnerability management

POA&M processes

Change control

Communication

Job description

Merlin Group in McLean, VA is seeking an Information Systems Security Manager (ISSM) to own daily security compliance and continuous monitoring for FedRAMP authorization. You will coordinate access, vulnerability scanning, POA&M management, change control, and the compliance calendar, while clearly communicating risks to leadership.

The role emphasizes both people and process, requiring strong communication with customers, risk framing, and proactive governance across security controls and