FedRAMP ISSO Lead for Federal Authorization

Cribl; Columbus (OH); Remote; USD 128,000 - 200,000; Full time

Benefits offered by this job

Health benefits

Equity

Retirement plan (401k)

Job summary

Cribl is seeking a FedRAMP ISSO to own and drive the security posture for our FedRAMP Moderate cloud environment. You will lead the compliance program end-to-end, including SSP maintenance, POA&M lifecycle, and agency relationships, leveraging AI/automation to streamline evidence collection and reporting.

You’ll collaborate with engineering, product, and legal teams, ensuring continuous monitoring, vulnerability management, and timely remediation while communicating clearly with federal auditors

Qualifications

• 5+ years of information security experience with at least 3 years in a dedicated FedRAMP ISSO/ISSE role at a CSP.
• Deep knowledge of NIST SP 800-53 Rev 5 and the FedRAMP ecosystem baseline.
• Proven experience authoring and maintaining large System Security Plans (SSPs).
• Hands-on POA&M management: open, track, aging, escalate, and close findings.

Responsibilities

• Own the FedRAMP program end-to-end as the single accountable leader for Moderate authorization.
• Maintain and defend the System Security Plan (SSP) with accurate control implementations.
• Lead POA&M management from findings to closure with remediation timelines.
• Run continuous monitoring: ConMon, vulnerability scans, and incident reporting per FedRAMP.
• Collaborate with engineering/DevOps to implement security controls and automate evidence collection.

Skills

FedRAMP

ISSO/ISSE

NIST SP 800-53 Rev 5

3PAO experience

Automation/AI tooling

Cloud security

Tools

OSCAL

Automation tooling

Job description

Cribl is seeking a FedRAMP ISSO to own and drive the security posture for our FedRAMP Moderate cloud environment. You will lead the compliance program end-to-end, including SSP maintenance, POA&M lifecycle, and agency relationships, leveraging AI/automation to streamline evidence collection and reporting.

You’ll collaborate with engineering, product, and legal teams, ensuring continuous monitoring, vulnerability management, and timely remediation while communicating clearly with federal auditors