Government Compliance Program Manager

MEDITECH; Canton (MA); On-site; USD 120,000 - 180,000; Full time

Job summary

MEDITECH in the United States is seeking a Government Compliance Program Manager to lead ITSG-33 and FedRAMP readiness for SaaS and cloud operations. You will bridge security teams and regulators, write security documentation, and drive remediation tracking.

Responsibilities include maintaining SSPs/SCTMs, mapping controls to NIST SP 800-53, coordinating audits with 3PAOs, and ensuring evidence collection for assessments. This role supports cloud services leadership.

Qualifications

• Experience applying government security standards and frameworks.
• Ability to translate regulatory requirements into engineering and operations processes.
• Proven track record coordinating audits and remediation activities.

Responsibilities

• Authoring, updating, and maintaining core government compliance packages, including SSPs and SCTMs.
• Mapping operational controls across NIST SP 800-53 and CCCS Medium Cloud Profile.
• Tracking control coverage and document evidence for identity management, access control, encryption standards, and monitoring routines.
• Coordinating day-to-day operations during third-party assessment (3PAOs) and government audits.
• Managing and updating the POA&M register—working with Cloud/DevOps and Engineering teams to ensure timely remediation of vulnerabilities and findings.
• Collecting, organizing, and validating audit evidence for smooth assessment lifecycles.

Skills

Regulatory compliance

IT governance

NIST SP 800-53

FedRAMP

Security documentation

Job description

Description

As a Government Compliance Program Manager, you will be heavily involved in preparing our SaaS product and cloud operations for ITSG-33 and FedRAMP authorizations, as well as maintaining our broader data protection and privacy standards. Working under the direction of security leadership, you will serve as the operational bridge between technical teams and regulatory frameworks—writing security documentation, mapping control implementations, tracking remediation items, and facilitating auditor requests. As a member of our Cloud Services team, your job would involve:

• Authoring, updating, and maintaining core government compliance packages, including System Security Plans (SSPs), Security Control Traceability Matrices (SCTMs), and supporting policy documents
• Mapping operational controls across NIST SP 800-53 and CCCS Medium Cloud Profile to ensure clear alignment with engineering and IT workflows
• Tracking control coverage and document evidence for identity management, access control, encryption standards, and monitoring routines
• Coordinating day-to-day operations during third-party assessment (3PAOs) and government audits
• Managing and updating the Plan of Action and Milestones (POA&M) register—working directly with Cloud/DevOps and Engineering teams to ensure timely remediation of vulnerabilities and findings
• Collecting, organizing, and validating audit evidence to ensure smooth assessment lifecycles