FedRAMP ISSO Lead - Automate Compliance & ConMon

Cribl; Concord (NH); Remote; USD 128,000 - 200,000; Full time

Job summary

Cribl is seeking a FedRAMP ISSO to own and drive the security posture for our FedRAMP Moderate cloud. You will shape compliance operations using AI and automation, collaborating with engineering, product, legal, and federal customers to keep the authorization healthy.

You will manage SSP, continuous monitoring, and POA&M lifecycle, lead annual 3PAO assessments, and serve as the primary federal contact. Remote-first, multiple time zones apply.

Qualifications

• 5+ years of information security with FedRAMP ISSO/ISSE ownership.
• Deep knowledge of NIST SP 800-53 Rev 5 and FedRAMP baseline.
• Experience authoring and maintaining large System Security Plans (SSP).
• Hands‑on POA&M management from finding to closure.
• Experience running a continuous monitoring program and coordinating 3PAO assessments.
• Ability to automate evidence collection and reporting using automation/AI tools.

Responsibilities

• Own the FedRAMP program end-to-end (SSP, ConMon, POA&M lifecycle).
• Maintain and defend the SSP with accurate system architecture and controls.
• Drive POA&M from finding to closure with engineering coordination.
• Lead ConMon reporting and vulnerability triage.
• Automate evidence collection and reporting workflows.
• Coordinate annual 3PAO assessments and auditor inquiries.
• Interface with agency customers and FedRAMP PMO as primary point of contact.
• Collaborate with Engineering/DevOps on secure controls and remediation.
• Outline AI/automation opportunities to streamline compliance operations.

Skills

FedRAMP ISSO

NIST SP 800-53 Rev 5

SSP management

POA&M management

Continuous monitoring (ConMon)

3PAO coordination

Automation & AI tooling

Cloud security

Tools

OSCAL

Job description

Cribl is seeking a FedRAMP ISSO to own and drive the security posture for our FedRAMP Moderate cloud. You will shape compliance operations using AI and automation, collaborating with engineering, product, legal, and federal customers to keep the authorization healthy.

You will manage SSP, continuous monitoring, and POA&M lifecycle, lead annual 3PAO assessments, and serve as the primary federal contact. Remote-first, multiple time zones apply.