Principal GCO: FedRAMP & Compliance Program Leader

Mimecast North America, Inc.; Minneapolis (MN); Hybrid; USD 132,000 - 198,000; Full time

Job summary

Mimecast in Minneapolis, Columbus, or Lexington is seeking a Principal GCO High Compliance Systems Advisor to own its rigorous certification program, including FedRAMP authorization. You will drive technical control design, document controls, and manage third‑party risk management in a cross‑functional environment.

You will partner with Engineering, Security, Legal, Product, and SMEs to keep controls audit‑ready, and report progress to GCO leadership while engaging clients, regulators, and

Qualifications

• Experience leading a FedRAMP Rev 5 Moderate authorization from kickoff to ATO.
• Draft, review and maintain SSPs, POA&Ms, and control narratives with SMEs.
• Collaborate with Engineering, Security, Legal and Product to align documentation.
• Strong technical writing and presentation skills for assessors and regulators.

Responsibilities

• Own end-to-end FedRAMP authorization activity including controls and evidence.
• Chair mandatory FedRAMP meetings with 3PAOs, sponsors, and clients.
• Draft and maintain control documentation and evidence libraries.
• Translate complex implementations into assessor-ready narratives.
• Monitor control mappings across FedRAMP, ISO, SOC 2, and NIST.
• Report risks, milestones, and blockers to GCO leadership.
• Stay current on federal and commercial assurance regimes.

Skills

FedRAMP Rev 5 Moderate

Technical control design

Technical writing

Regulatory compliance

GRC familiarity

Tools

Drata

Responsive

Job description

Mimecast in Minneapolis, Columbus, or Lexington is seeking a Principal GCO High Compliance Systems Advisor to own its rigorous certification program, including FedRAMP authorization. You will drive technical control design, document controls, and manage third‑party risk management in a cross‑functional environment.

You will partner with Engineering, Security, Legal, Product, and SMEs to keep controls audit‑ready, and report progress to GCO leadership while engaging clients, regulators, and