Principal GCO High Compliance Systems Advisor

Mimecast Limited; Massachusetts; Hybrid; USD 132,000 - 198,000; Full time

Job summary

Mimecast is seeking a Principal GCO High Compliance Systems Advisor to own the high-compliance certification program, including FedRAMP authorization, and to manage third-party risk. You will collaborate with Engineering, Security, Legal, Product, and other SMEs to ensure controls and evidence stay audit-ready, while representing Mimecast in sessions with clients, assessors, and regulators.

You will report to the SVP / Head of GCO, with hybrid work options in designated US offices.

Qualifications

• Experience leading FedRAMP Rev 5 Moderate authorization.
• Drafting and maintaining technical control documentation with SMEs.
• Ability to align Engineering, Security, Legal, and Product teams.

Responsibilities

• Own FedRAMP authorization activity end-to-end, including control design and evidence collection.
• Chair FedRAMP meetings with 3PAOs, sponsors, and clients.
• Draft and maintain technical control documentation and narratives.

Skills

FedRAMP Rev 5

Control design

Documentation

SSP/POA&M

Auditing & evidence

NIST 800-53

ISO 27001

SOC 2

Vendor risk/TPRM

Regulatory liaison

Tools

Drata

Responsive

GRC tools

Job description

About Mimecast

The work people build is worth protecting, and it's harder to protect than it used to be. AI agents now move at machine speed with human-level access, and a small slip-up can become a very public one. We disrupt cybercriminal activity before that happens. We think fast, go big, and always demand more of ourselves. We work hard, deliver, and repeat. We grow with real determination and put success well within reach. We push each other to be better and expect to be pushed back, in a community built on respect, where everyone is counted.

About Mimecast

The work people build is worth protecting, and it's harder to protect than it used to be. AI agents now move at machine speed with human-level access, and a small slip-up can become a very public one. We disrupt cybercriminal activity before that happens. We think fast, go big, and always demand more of ourselves. We work hard, deliver, and repeat. We grow with real determination and put success well within reach. We push each other to be better and expect to be pushed back, in a community built on respect, where everyone is counted.

Work Protected.

Overview

Mimecast's Governance and Certification Office (GCO) is looking for a Principal GCO High Compliance Systems Advisor to own its high-compliance certification program, including FedRAMP authorization, lead technical control design and documentation, and manage third-party risk management (TPRM).

The GCO oversees regulatory, governance, certification, and third-party risk assurance across Mimecast's multi-jurisdictional SaaS security business. You'll partner with Engineering, Security, Legal, Product, and departmental subject matter experts to keep controls and evidence audit-ready. You'll also represent Mimecast in mandatory sessions with clients, assessors, and regulators.

You'll report to the SVP / Head of GCO. This role can be based in the Minneapolis, Columbus, or Lexington offices on a hybrid model.

In your first 12 months, success means keeping FedRAMP Moderate authorization activities on schedule without a continuity gap during the transition; maintaining current, consistent control documentation mapped across active certification frameworks; establishing a defined TPRM cadence with clear remediation ownership; and building trusted relationships with Engineering, Security, and Product subject matter experts.

What You'll Do

• Own end-to-end FedRAMP authorization activity, including control design, documentation (SSP, POA&Ms, and control narratives), and evidence collection.
• Chair mandatory FedRAMP meetings, including kick-offs, control walkthroughs, and readiness and assessment sessions with third-party assessment organizations (3PAOs), agency sponsors, and client stakeholders.
• Draft, review, and maintain technical control documentation across the certification portfolio, ensuring accuracy, consistency, and audit traceability.
• Work with Engineering, IT Security, Product, and Infrastructure subject matter experts to translate technical implementations into assessor-ready control narratives.
• Maintain the control evidence library and mappings across FedRAMP, ISO, SOC 2, and NIST frameworks to reduce duplicate evidence requests.
• Report program risks, milestones, and open items to GCO leadership, escalating blockers that need cross-functional sponsorship.
• Monitor emerging federal and commercial assurance regimes and assess their implications for Mimecast's certification roadmap.

What You'll Bring

• Experience leading a FedRAMP Rev 5 Moderate impact-level authorization, including chairing all mandatory client and regulator meetings, designing technical controls, and preparing the full documentation set: SSP, control implementation summaries, and POA&Ms.
• Extensive experience drafting, reviewing, and maintaining technical control documentation in partnership with departmental subject matter experts, ensuring control descriptions accurately reflect implementation.
• Ability to contribute your own subject matter expertise while aligning Engineering, Security, Legal, and Product teams around a shared documentation position.
• Confidence presenting to external assessors, regulators, and client security teams under scrutiny.
• A structured approach to maintaining detailed, cross-referenced evidence libraries while keeping the broader risk picture in view.
• Ability to work independently with evolving regulatory guidance, including FedRAMP 20x, and translate it into a workable internal plan.
• Experience auditing controls for ISO 27001, SOC 2, and other security certification schemes, managing external auditor relationships, and closing findings.
• Hands-on preparation for FedRAMP 20x under the CR26 framework, ideally spanning Classes A-C, including automatic control monitoring, Key Security Indicators (KSIs), and supporting technologies such as Paramify.
• Familiarity with GRC and compliance tools such as Drata and Responsive.
• Working knowledge of NIST 800-53, CIS Controls, and CSA STAR / CCM, including how they map to FedRAMP and ISO control sets.
• Experience in a PE-backed or IPO-track environment where governance evidence must support regulatory requirements and investor due diligence.
• Exposure to enterprise risk frameworks, such as bowtie methodology, to explain control gaps as business risks to non-technical stakeholders.
• Project management experience running multi-month, cross-functional certification programs with competing deadlines.
• Strong technical writing skills, turning complex control details into clear, assessor-ready narratives.

The base salary range for this position is 132,000 - 198,000 USD plus benefits. This range represents the minimum and maximum new hire compensation for this role. The position may also be eligible for incentive plans and additional benefits, in accordance with company policy and local regulations. Our salary ranges are determined by role, level, and location with individual compensation also dependent on factors such as qualifications, experience, and skills. Final offers will reflect these considerations and may vary accordingly.

Belonging at Mimecast

Cybersecurity is a community effort. That’s why we’re committed to building an inclusive, diverse community that celebrates and welcomes everyone – unless they’re a cybercriminal, of course.

We’re proud to be an Equal Opportunity and Affantuational Action Employer, and we’d encourage you to join us whatever your background. We particularly welcome applicants from traditionally underrepresented groups.

We consider everyone equally: your race, age, religion, sexual orientation, gender identity, ability, marital status, nationality, or any other protected characteristic won’t affect your application.

If you require any adjustments or accommodations due to a disability, or any other reason that may help you in your interview process, please let us know by emailing [e-mail].

Due to certain obligations to our customers, an offer of employment will be subject to your successful completion of applicable background checks, conducted in accordance with local law.

It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment.