Lead Program Manager - FedRAMP.

Accountabilities:

• Own and manage the end-to-end federal compliance program within the Governance, Risk, and Compliance (GRC) function, with primary responsibility for FedRAMP Class D (High) and Department of Defense Impact Level 4 (IL4) requirements.

• Lead continuous monitoring activities, maintain System Security Plans (SSPs), coordinate evidence collection, and prepare mandatory compliance documentation and reporting.

• Plan, coordinate, and oversee security assessments, working closely with independent third-party assessors, agency Authorizing Officials, and internal control owners throughout the authorization process.

• Manage the identification, tracking, and resolution of assessment findings, control deficiencies, and compliance gaps, ensuring clear ownership, realistic deadlines, and documented closure evidence.

• Partner with Security, Engineering, and Product teams to translate complex federal security requirements into practical implementation guidance and evaluate the compliance impact of architectural changes, product features, and system integrations.

• Collaborate with technical stakeholders to assess and resolve issues involving system boundaries, inherited controls, and shared responsibility models across AWS GovCloud, internal services, and third-party dependencies.

• Communicate the organization's security and compliance posture, authorization status, and customer responsibilities clearly to federal agencies, external assessors, prospective customers, and internal leadership.

• Evaluate security and compliance requirements associated with prospective federal contracts, identifying potential risks, implementation requirements, and readiness considerations.

• Align federal security controls, policies, and supporting evidence with broader GRC initiatives, including CJIS, SOC 2, and applicable United Kingdom regulatory requirements.

• Monitor evolving federal security regulations and frameworks, incorporating new requirements into compliance strategies, program priorities, and operational processes.

• Provide regular updates to GRC leadership on program performance, compliance readiness, emerging risks, assessment progress, and remediation priorities.

• Drive cross-functional accountability and maintain strong collaboration across technical and operational teams to ensure sustainable compliance and continuous security improvement.

Requirements:

• At least 7 years of professional experience in Governance, Risk, Compliance (GRC), cybersecurity, or security assurance, including substantial responsibility for federal compliance programs.

• Proven experience managing complex compliance initiatives within SaaS, cloud computing, or technology organizations, with direct involvement in security assessments, documentation, evidence collection, and remediation activities.

• Strong working knowledge of NIST Special Publication 800-53, including security control implementation, evidence validation, assessment preparation, and continuous compliance monitoring.

• Demonstrated experience maintaining security documentation, particularly System Security Plans (SSPs), coordinating independent assessments, and managing compliance findings through resolution.

• Solid technical understanding of cloud infrastructure, system architectures, security boundaries, inherited controls, and shared responsibility models.

• Ability to collaborate effectively with Engineering and Security teams to evaluate technical compliance decisions and translate regulatory requirements into actionable implementation guidance.

• Excellent communication and stakeholder management skills, with the ability to explain complex security and compliance topics to technical teams, executive leadership, external assessors, and government stakeholders.

• Strong project and program management capabilities, including the ability to operate independently, manage competing priorities, coordinate cross-functional commitments, and proactively escalate risks without relying on formal authority.

• Demonstrated analytical thinking, sound compliance judgment, and the ability to navigate ambiguity in evolving regulatory and technical environments.

• Must be a U.S. citizen due to the nature of the federal compliance responsibilities.

• Must be legally authorized to work in the United States without employer-sponsored visa support.

• Preferred: Direct, hands-on experience managing FedRAMP Moderate and/or High authorization programs, including SSP maintenance, continuous monitoring, and assessment coordination.

• Preferred: Experience supporting Department of Defense IL4 and/or IL5 security compliance requirements.

• Preferred: Practical experience with AWS GovCloud, particularly security control inheritance and cloud shared responsibility models.

• Preferred: Experience supporting federal agency authorization processes and evaluating security requirements for government contracts.

• Preferred: Experience aligning security controls and evidence across multiple frameworks, including CJIS, SOC 2, ISO 27001, and international public sector compliance standards.

• Preferred: Familiarity with Cybersecurity Maturity Model Certification (CMMC) and NIST SP 800-171.

• Strong interpersonal qualities, including humility, curiosity, openness to collaboration, and a systems-oriented mindset that connects security frameworks, technical environments, and business priorities.

• A proactive communication style and the ability to build trust, maintain stakeholder alignment, and foster a collaborative approach to compliance.

Benefits:

• Fully remote working arrangements within the United States, subject to approved hiring locations.

• Full-time employment opportunity.

• Opportunity to work on high-impact federal security and compliance initiatives.

• Collaborative environment working alongside experienced professionals across Security, Engineering, Product, and GRC teams.

• Exposure to advanced cloud technologies, government security frameworks, and complex federal compliance programs.

• Opportunities to influence enterprise security strategy and contribute to the development of secure technology solutions supporting public safety and government organizations.

• Occasional business travel for team collaboration, internal meetings, or customer engagements.

• Access to office locations in New York City, Boston, and Manchester, UK, where applicable.

• The opportunity to contribute to a mission-driven organization focused on improving public safety and supporting communities through innovative technology.