FedRAMP ISSO & GRC Lead — Certification Automation

Semperis; Hoboken (NJ); Hybrid; USD 150,000 - 195,000; Full time

Job summary

Semperis is seeking an experienced Information System Security Officer (ISSO) to lead FedRAMP 20x in a hybrid, US-based setting. You will define certification boundaries, deploy KSIs, and automate evidence pipelines across FedRAMP disciplines.

You’ll collaborate with leadership, security engineers, and product teams to ensure compliant design and ongoing governance. The role requires deep GRC and cloud security expertise, with hands-on FedRAMP ISSO experience and relevant certifications.

Qualifications

• 6+ years in GRC, information security compliance, or IT audit, incl. FedRAMP ISSO exposure.
• One of CRISC, CISM, CISA, CISSP or equivalent security/audit credential.
• Direct implementation of NIST SP 800-53 controls within a FedRAMP authorization.

Responsibilities

• Lead FedRAMP 20x program for in-scope product(s) and govern project charter, governance, and RACI.
• Staffing proposals for FedRAMP roles with ISSM; sign charter and published work plan.
• Design and deliver KSIs, evidence pipelines, and SOCCAL outputs; ensure automation over manual spreadsheets.
• Embed FedRAMP controls into SDLC and cloud infra designs; set testable criteria.
• Deliver FedRAMP Marketplace listing and 20x Certification Package; support post‑certification maintenance.

Skills

GRC experience

Information security

FedRAMP ISSO

NIST SP 800-53

Cloud security (Azure/AWS)

Audit & governance

Vulnerability management

Certifications (CRISC/CISM/CISA/CISSP)

OSI/OSCAL compliance evidence

Tools

GRC automation tooling

Job description

Semperis is seeking an experienced Information System Security Officer (ISSO) to lead FedRAMP 20x in a hybrid, US-based setting. You will define certification boundaries, deploy KSIs, and automate evidence pipelines across FedRAMP disciplines.

You’ll collaborate with leadership, security engineers, and product teams to ensure compliant design and ongoing governance. The role requires deep GRC and cloud security expertise, with hands-on FedRAMP ISSO experience and relevant certifications.