Principal FedRAMP & Compliance Systems Advisor

Mimecast North America, Inc.; Lexington (MA); Hybrid; USD 132,000 - 198,000; Full time

Job summary

Mimecast seeks a Principal GCO High Compliance Systems Advisor to own FedRAMP authorization, lead control design, and manage third-party risk across certification programs. The role can be based in Minneapolis, Columbus, or Lexington on a hybrid model, collaborating with Engineering, Security, Legal, and Product teams to keep controls audit-ready.

In the first 12 months, success means keeping FedRAMP Moderate authorization activities on schedule, maintaining current control documentation mapped

Qualifications

• Experience leading a FedRAMP Rev 5 Moderate authorization (chairing client/regulator meetings).
• Experience drafting and maintaining technical control documentation with SMEs.
• Ability to align Engineering, Security, Legal, and Product around a shared documentation position.
• Confidence presenting to external assessors, regulators, and client security teams.
• Maintaining cross-referenced evidence libraries and broader risk view.
• Translate evolving FedRAMP guidance into an internal plan.
• Experience auditing ISO 27001, SOC 2, and other schemes; manage external auditors.
• Hands-on prep for FedRAMP 20x under CR26 with KSIs and Paramify.
• Familiarity with NIST 800-53, CIS, CSA STAR/CCM, mapping to FedRAMP/ISO.
• Experience in PE-backed or IPO-track environments.
• Exposure to bowtie risk frameworks to explain control gaps to non-tech stakeholders.
• Project management of multi-month cross-functional certification programs.
• Strong technical writing to turn control details into assessor-ready narratives.

Responsibilities

• Own end-to-end FedRAMP authorization activity, including control design, documentation (SSP, POA&Ms, and control narratives), and evidence collection.
• Chair mandatory FedRAMP meetings, including kick-offs, control walkthroughs, and readiness and assessment sessions with third-party assessment organizations (3PAOs), agency sponsors, and client stakeholders.
• Draft, review, and maintain technical control documentation across the certification portfolio, ensuring accuracy, consistency, and audit traceability.
• Work with Engineering, IT Security, Product, and Infrastructure subject matter experts to translate technical implementations into assessor-ready control narratives.
• Maintain the control evidence library and mappings across FedRAMP, ISO, SOC 2, and NIST frameworks to reduce duplicate evidence requests.
• Report program risks, milestones, and open items to GCO leadership, escalating blockers that need cross-functional sponsorship.
• Monitor emerging federal and commercial assurance regimes and assess their implications for Mimecast's certification roadmap.

Skills

FedRAMP

Technical writing

Project management

Risk management

Cross-functional collaboration

Regulatory compliance

Public speaking

Tools

Drata

Responsive

Job description

Mimecast seeks a Principal GCO High Compliance Systems Advisor to own FedRAMP authorization, lead control design, and manage third-party risk across certification programs. The role can be based in Minneapolis, Columbus, or Lexington on a hybrid model, collaborating with Engineering, Security, Legal, and Product teams to keep controls audit-ready.

In the first 12 months, success means keeping FedRAMP Moderate authorization activities on schedule, maintaining current control documentation mapped