Lead FedRAMP ISSO: Automation-Driven Compliance (Remote)

Cribl; United States; Remote; USD 150,000 - 190,000; Full time

Job summary

Cribl is seeking a FedRAMP ISSO to own and drive the security posture, compliance operations, and continuous monitoring for our FedRAMP Moderate cloud environment. You will be the single accountable leader, shaping the compliance strategy and leveraging automation to streamline evidence collection and reporting.

You’ll partner with engineering, product, legal, and agency customers to maintain authorization health, defend SSPs, manage POA&M from finding to closure, and run ConMon and annual 3PAO

Qualifications

• 5+ years of information security experience, with at least 3 years in a dedicated FedRAMP ISSO or ISSE role at a Cloud Service Provider.
• Deep knowledge of NIST SP 800-53 Rev 5 and the FedRAMP Ecosystem baseline.
• Proven experience authoring and maintaining large-scale System Security Plans (SSP).
• Hands-on POA&M management: opening, tracking, aging, escalating, and driving findings to closure.
• Direct experience running a continuous monitoring program end-to-end, including monthly ConMon reporting and coordination of annual 3PAO assessments.
• Experience working with Third Party Assessment Organizations (3PAOs) through full assessment cycles, including evidence gathering and auditor facilitation.
• Demonstrated ability to use automation, scripting, or AI tools to improve compliance operations.
• Familiarity with cloud environments and their security implications; AWS GovCloud experience strongly preferred, Azure Government or GCP also valued.
• Strong written communication skills for federal auditors and agency security teams.
• Active security certification: CISSP, Certified Authorization Professional (CAP/CGRC), or CISM.

Responsibilities

• Own FedRAMP program end-to-end: serve as the single accountable leader for our FedRAMP Moderate authorization, including the SSP, continuous monitoring program, POA&M lifecycle, and agency relationships.
• Maintain the System Security Plan: ensure SSP reflects system architecture, control implementations, operational changes, and any approved uses of automation or AI.
• Drive POA&M management from finding to closure: track findings, coordinate remediation timelines, and build scalable workflows with AI-assisted triage.
• Lead continuous monitoring: monthly and annual ConMon reporting, vulnerability triage, configuration reviews, and incident reporting per FedRAMP.
• Run annual 3PAO assessments from start to finish: prepare documentation, manage logistics, and respond to auditor inquiries.
• Assess the security impact of system changes: evaluate new features and AI capabilities through change management.
• Serve as the primary federal point of contact: build relationships with agency customers, AOs, and the FedRAMP PMO.
• Collaborate with engineering and DevOps: improve control validation and automation, including IaC integrations and AI workflows.
• Coordinate security incident response: ensure timely, accurate agency notification and defensible documentation.
• Monitor evolving federal guidance: translate NIST/FedRAMP/OMB/CISA guidance into actionable directions for the team.
• Remote-first operations with multi-timezone collaboration.

Skills

FedRAMP ISSO experience

NIST SP 800-53 Rev 5

SSP authoring

POA&M management

Continuous Monitoring

3PAO coordination

Automation / AI in compliance

Cloud security

Strong written communication

Security certifications (CISSP/CAP/CIS

Job description

Cribl is seeking a FedRAMP ISSO to own and drive the security posture, compliance operations, and continuous monitoring for our FedRAMP Moderate cloud environment. You will be the single accountable leader, shaping the compliance strategy and leveraging automation to streamline evidence collection and reporting.

You’ll partner with engineering, product, legal, and agency customers to maintain authorization health, defend SSPs, manage POA&M from finding to closure, and run ConMon and annual 3PAO