Principal GCO High Compliance Systems Advisor

Mimecast North America, Inc.; Lexington (MA); Hybrid; USD 132,000 - 198,000; Full time

Job summary

Mimecast seeks a Principal GCO High Compliance Systems Advisor to own FedRAMP authorization, lead control design, and manage third-party risk across certification programs. The role can be based in Minneapolis, Columbus, or Lexington on a hybrid model, collaborating with Engineering, Security, Legal, and Product teams to keep controls audit-ready.

In the first 12 months, success means keeping FedRAMP Moderate authorization activities on schedule, maintaining current control documentation mapped

Qualifications

• Experience leading a FedRAMP Rev 5 Moderate authorization (chairing client/regulator meetings).
• Experience drafting and maintaining technical control documentation with SMEs.
• Ability to align Engineering, Security, Legal, and Product around a shared documentation position.
• Confidence presenting to external assessors, regulators, and client security teams.
• Maintaining cross-referenced evidence libraries and broader risk view.
• Translate evolving FedRAMP guidance into an internal plan.
• Experience auditing ISO 27001, SOC 2, and other schemes; manage external auditors.
• Hands-on prep for FedRAMP 20x under CR26 with KSIs and Paramify.
• Familiarity with NIST 800-53, CIS, CSA STAR/CCM, mapping to FedRAMP/ISO.
• Experience in PE-backed or IPO-track environments.
• Exposure to bowtie risk frameworks to explain control gaps to non-tech stakeholders.
• Project management of multi-month cross-functional certification programs.
• Strong technical writing to turn control details into assessor-ready narratives.

Responsibilities

• Own end-to-end FedRAMP authorization activity, including control design, documentation (SSP, POA&Ms, and control narratives), and evidence collection.
• Chair mandatory FedRAMP meetings, including kick-offs, control walkthroughs, and readiness and assessment sessions with third-party assessment organizations (3PAOs), agency sponsors, and client stakeholders.
• Draft, review, and maintain technical control documentation across the certification portfolio, ensuring accuracy, consistency, and audit traceability.
• Work with Engineering, IT Security, Product, and Infrastructure subject matter experts to translate technical implementations into assessor-ready control narratives.
• Maintain the control evidence library and mappings across FedRAMP, ISO, SOC 2, and NIST frameworks to reduce duplicate evidence requests.
• Report program risks, milestones, and open items to GCO leadership, escalating blockers that need cross-functional sponsorship.
• Monitor emerging federal and commercial assurance regimes and assess their implications for Mimecast's certification roadmap.

Skills

FedRAMP

Technical writing

Project management

Risk management

Cross-functional collaboration

Regulatory compliance

Public speaking

Tools

Drata

Responsive

Job description

About Mimecast

About Mimecast The work people build is worth protecting, and it's harder to protect than it used to be. AI agents now move at machine speed with human-level access, and a small slip-up can become a very public one. We disrupt cybercriminal activity before that happens. We think fast, go big, and always demand more of ourselves. We work hard, deliver, and repeat. We grow with real determination and put success well within reach. We push each other to be better and expect to be pushed back, in a community built on respect, where everyone is counted. Work Protected.

Overview

Mimecast's Governance and Certification Office (GCO) is looking for a Principal GCO High Compliance Systems Advisor to own its high-compliance certification program, including FedRAMP authorization, lead technical control design and documentation, and manage third-party risk management (TPRM). The GCO oversees regulatory, governance, certification, and third-party risk assurance across Mimecast's multi-jurisdictional SaaS security business. You'll partner with Engineering, Security, Legal, Product, and departmental subject matter experts to keep controls and evidence audit-ready. You'll also represent Mimecast in mandatory sessions with clients, assessors, and regulators. You'll report to the SVP / Head of GCO. This role can be based in the Minneapolis, Columbus, or Lexington offices on a hybrid model. In your first 12 months, success means keeping FedRAMP Moderate authorization activities on schedule without a continuity gap during the transition; maintaining current, consistent control documentation mapped across active certification frameworks; establishing a defined TPRM cadence with clear remediation ownership; and building trusted relationships with Engineering, Security, and Product subject matter experts.

What You'll Do

• Own end-to-end FedRAMP authorization activity, including control design, documentation (SSP, POA&Ms, and control narratives), and evidence collection.
• Chair mandatory FedRAMP meetings, including kick-offs, control walkthroughs, and readiness and assessment sessions with third-party assessment organizations (3PAOs), agency sponsors, and client stakeholders.
• Draft, review, and maintain technical control documentation across the certification portfolio, ensuring accuracy, consistency, and audit traceability.
• Work with Engineering, IT Security, Product, and Infrastructure subject matter experts to translate technical implementations into assessor-ready control narratives.
• Maintain the control evidence library and mappings across FedRAMP, ISO, SOC 2, and NIST frameworks to reduce duplicate evidence requests.
• Report program risks, milestones, and open items to GCO leadership, escalating blockers that need cross-functional sponsorship.
• Monitor emerging federal and commercial assurance regimes and assess their implications for Mimecast's certification roadmap.

What You'll Bring

• Experience leading a FedRAMP Rev 5 Moderate impact-level authorization, including chairing all mandatory client and regulator meetings, designing technical controls, and preparing the full documentation set: SSP, control implementation summaries, and POA&Ms.
• Extensive experience drafting, reviewing, and maintaining technical control documentation in partnership with departmental subject matter experts, ensuring control descriptions accurately reflect implementation.
• Ability to contribute your own subject matter expertise while aligning Engineering, Security, Legal, and Product teams around a shared documentation position.
• Confidence presenting to external assessors, regulators, and client security teams under scrutiny.
• A structured approach to maintaining detailed, cross-referenced evidence libraries while keeping the broader risk picture in view.
• Ability to work independently with evolving regulatory guidance, including FedRAMP 20x, and translate it into a workable internal plan.
• Experience auditing controls for ISO 27001, SOC 2, and other security certification schemes, managing external auditor relationships, and closing findings.
• Hands-on preparation for FedRAMP 20x under the CR26 framework, ideally spanning Classes A-C, including automatic control monitoring, Key Security Indicators (KSIs), and supporting technologies such as Paramify.
• Familiarity with GRC and compliance tools such as Drata and Responsive.
• Working knowledge of NIST 800-53, CIS Controls, and CSA STAR / CCM, including how they map to FedRAMP and ISO control sets.
• Experience in a PE-backed or IPO-track environment where governance evidence must support regulatory requirements and investor due diligence.
• Exposure to enterprise risk frameworks, such as bowtie methodology, to explain control gaps as business risks to non-technical stakeholders.
• Project management experience running multi-month, cross-functional certification programs with competing deadlines.
• Strong technical writing skills, turning complex control details into clear, assessor-ready narratives.

The base salary range for this position is 132,000 - 198,000 USD plus benefits. This range represents the minimum and maximum new hire compensation for this role. The position may also be eligible for incentive plans and additional benefits, in accordance with company policy and local regulations. Our salary ranges are determined by role, level, and location with individual compensation also dependent on factors such as qualifications, experience, and skills. Final offers will reflect these considerations and may vary accordingly.

Belonging at Mimecast Cybersecurity is a community effort. That’s why we’re committed to building an inclusive, diverse community that celebrates and welcomes everyone – unless they’re a cybercriminal, of course. We’re proud to be an Equal Opportunity and Aff

We particularly welcome applicants from traditionally underrepresented groups. We consider everyone equally: your race, age, religion, sexual orientation, gender identity, ability, marital status, nationality, or any other protected characteristic won’t affect your application. If you require any adjustments or accommodations due to a disability, or any other reason that may help you in your interview process, please let us know by emailing [e-mail].

Due to certain obligations to our customers, an offer of employment will be subject to your successful completion of applicable background checks, conducted in accordance with local law. It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. We save companies the embarrassment of awkward data slip ups by disrupting cybercriminal activity. We think fast, go big and always demand more. We work hard, deliver – and repeat. We grow with meaningful determination. And put success well within our reach. We empower each other, live by our values, and always deliver on our purpose. We push each other to be better and expect to be pushed back. This is a community of respect. Where everyone is counted.