Security Governance Manager

Responsibilities

• Lead and mature the Security Governance function as part of the broader Security team, covering strategy, processes, ownership, reporting, and continuous improvement.
• Maintain and strengthen Unison’s authorizations and certifications, including FedRAMP, IL4, and CMMC, by managing documentation, SSP updates, evidence quality, control-owner coordination, audit readiness, and annual assessment support.
• Support FedRAMP continuous monitoring activities, including recurring evidence collection, monthly and annual deliverables, risk documentation, remediation commitments, approvals, and deadlines.
• Coordinate with agency Authorizing Officials, 3
  
  PAOs, agency stakeholders, auditors, and control owners through assessments and ongoing authorization activity.
• Own the lifecycle of security policies, standards, and procedures, keeping documentation aligned with actual business and technical practice.
• Manage customer trust and assurance activities, including customer security reviews, questionnaires, RFPs, due-diligence responses, and reusable evidence packages.
• Communicate governance, compliance, audit, and risk topics clearly to technical teams, customers, auditors, executives, and business stakeholders.

• 6+ years in GRC, security governance, compliance, audit, or risk management.
• Hands‑on FedRAMP experience, including authorization, continuous monitoring, SSP maintenance, evidence management, assessments, annual assessment support, and POA&M coordination.
• Exposure to other federal authorizations and certifications such as DoD IL4/IL5 or CMMC.
• Working knowledge of NIST SP 800-53 and the control expectations behind FedRAMP, CMMC, and similar programs, including authorization documentation and audit evidence practices.
• Proven ability to manage people and vendors and to communicate credibly with auditors, technical teams, customers, and executives.
• Strong written communication skills, including the ability to produce clear policies, procedures, control narratives, customer responses, risk summaries, and executive‑ready updates.