ISSM: FedRAMP & Compliance Lead (Cloud)

Constellation GovCloud; McLean (VA); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

On-site gym

401(k) with employer match

Unlimited PTO

Medical, dental, and vision insurance

Job summary

Merlin Group in McLean, VA seeks an Information System Security Manager (ISSM) to own day-to-day security compliance and FedRAMP continuous monitoring. You will coordinate access authorization, POA&M, vulnerability scanning, change control, and lead risk communications.

The role requires clear, calm communication with customers under pressure, ability to work across technical, customer, and leadership audiences, and strong project discipline.

Qualifications

• 5+ years as an ISSM with CSPs in FedRAMP environments.
• Direct, hands-on experience with FedRAMP Rev 5, 20x, and CR26 requirements.
• Knowledge of vulnerability management, POA&M processes, and change control in regulated settings.
• Ability to communicate security/compliance to customers clearly and calmly.

Responsibilities

• Coordinate access authorization, approvals, and quarterly reviews.
• Maintain POA&M with status, owners, and due dates; coordinate remediation.
• Perform vulnerability scanning and report results to stakeholders.
• Manage the Change Control Board and prepare Security Impact Assessments.
• Track the recurring compliance calendar (IRCP, testing, reviews, ROB).
• Coordinate SBOM submissions and LMS for security awareness training.
• Monitor FedRAMP changes (Rev 5, 20x, CR26) and assess impact.

Skills

ISSM experience

FedRAMP knowledge

Vulnerability management

POA&M processes

Change control

Communication

Tools

Vulnerability scanning tools

POA&M tracking tools

CCB administration

Job description

Merlin Group in McLean, VA seeks an Information System Security Manager (ISSM) to own day-to-day security compliance and FedRAMP continuous monitoring. You will coordinate access authorization, POA&M, vulnerability scanning, change control, and lead risk communications.

The role requires clear, calm communication with customers under pressure, ability to work across technical, customer, and leadership audiences, and strong project discipline.