Principal FedRAMP & Compliance Systems Lead

Mimecast Limited; Lexington (MA); Hybrid; USD 132,000 - 198,000; Full time

Job summary

Mimecast Limited seeks a Principal GCO High Compliance Systems Advisor to own the FedRAMP program, lead control design and documentation, and manage third-party risk across a multi-jurisdictional SaaS security stack.

You will partner with Engineering, Security, Legal, Product, and other SMEs to keep controls audit-ready and to represent Mimecast in sessions with clients, assessors, and regulators. Hybrid work is available in multiple offices.

Qualifications

• Experience leading a FedRAMP Rev 5 Moderate authorization, including chairing meetings, designing controls, and preparing documentation (SSP, POA&Ms).
• Experience drafting, reviewing, and maintaining technical control documentation with SMEs.
• Ability to align Engineering, Security, Legal, and Product around a shared documentation position.
• Confidently presenting to assessors, regulators, and client security teams.
• Maintain cross-referenced evidence libraries and mappings across FedRAMP, ISO, SOC 2, and NIST frameworks.
• Work independently with evolving regulatory guidance, including FedRAMP 20x.
• Experience auditing controls for ISO 27001, SOC 2, and other schemes; manage auditor relationships.
• Hands-on prep for FedRAMP 20x under CR26 (Class A-C) with KSIs and supporting tech.
• Familiarity with GRC tools Drata and Responsive.
• Knowledge of NIST 800-53, CIS Controls, CSA STAR/CCM mapping to FedRAMP/ISO.
• Experience in PE-backed or IPO-track environments.
• Exposure to enterprise risk frameworks (bowtie).
• Project management of multi-month certification programs with cross-functional teams.
• Strong technical writing skills to produce assessor-ready narratives.

Responsibilities

• Own end-to-end FedRAMP authorization activity, including control design, documentation (SSP, POA&Ms), and evidence collection.
• Chair mandatory FedRAMP meetings with 3PAOs, agencies, and client stakeholders.
• Draft, review, and maintain technical control documentation across the certification portfolio.
• Translate technical implementations into assessor-ready control narratives with cross-functional teams.
• Design and mature the third-party risk management program, including vendor risk tiering and remediation tracking.
• Maintain control evidence library and mappings across FedRAMP, ISO, SOC 2, and NIST frameworks.
• Report program risks, milestones, and blockers to GCO leadership.
• Monitor emerging assurance regimes and their impact on Mimecast’s roadmap.

Skills

FedRAMP authorization

Technical controls design

Cross-functional collaboration

Technical writing

Presenting to assessors

GRC tools (Drata, Responsive)

NIST 800-53 knowledge

ISO 27001 / SOC 2 auditing

Project management of certification

IPO-track / PE-backed experience

Tools

Drata

Responsive

Paramify

Job description

Mimecast Limited seeks a Principal GCO High Compliance Systems Advisor to own the FedRAMP program, lead control design and documentation, and manage third-party risk across a multi-jurisdictional SaaS security stack.

You will partner with Engineering, Security, Legal, Product, and other SMEs to keep controls audit-ready and to represent Mimecast in sessions with clients, assessors, and regulators. Hybrid work is available in multiple offices.