FedRAMP Information System Security Officer; ISSO

At Semperis, our mission is to be a Force for Good. Starting with being a great place to work. We believe that when people feel valued, supported, and empowered, they do their best work. That’s why we focus on creating an employee experience rooted in purpose, growth, and balance. Semperis has been recognized as one of America’s Fastest‑Growing Cybersecurity Companies by the Inc.

5000, a DUNS 100 Top Startup to Work For, and a multi-year Inc. Best Workplace awardee.

Location: Hybrid In-Office:
Hoboken, NJ;
Addison, TX;
Phoenix, AZ; or Austin, TX

We protect some of the world's largest, most complex hybrid identity environments, and that mission depends on earning and keeping our customers' trust. Our GRC team is the engine behind that trust, running the certification and audit programs that let security‑conscious enterprises, regulated industries, and government customers confidently adopt our cloud products.

As the designated Information System Security Officer (ISSO), you will lead and execute day‑to‑day FedRAMP operational work r role will define and document the certification boundary, specify and deploy the mandatory Key Security Indicators (KSIs), and deliver the automated evidence pipeline, FedRAMP Trust Center, and Security Inbox that FedRAMP 20x requires.

This is a hands‑on, highly technical GRC role for someone who can guide how Semperis meets FedRAMP requirements and get into the details of continuous assurance automation. You will guide Semperis’s interpretation of each FedRAMP requirement and outline the implementation details directly to Semperis leadership, Security Assessors, and FedRAMP reviewers.

The role reports to the Head of Risk and Compliance, who serves as the FedRAMP Information System Security Manager (ISSM). You will work very closely with Security Engineering, Product/Engineering leadership, and Sales Government Solutions, and will be relied upon as the company’s day‑to‑day FedRAMP 20x subject matter expert.

In addition to FedRAMP responsibilities, you may support other Governance, Risk, Compliance, and Trust initiatives and certifications as needed to advance and mature Semperis’s GRC capabilities.

What you Will Do

FedRAMP Certification & Governance

• Mobilize the FedRAMP 20x Program for in‑scope product(s): guide the project charter, establish governance and reporting cadence, develop the stakeholder RACI, and work with project management to outline a viable work plan.

• Work with the FedRAMP ISSM to propose staffing of required FedRAMP roles for the certification project.

• Deliver a signed charter and a published work plan tracked against internal planning gates (executive go‑decision, security engineering work, listing‑readiness) so that no workstream is unowned.

• Establish the requirements for expanded use of our GRC system for Trust Center, controls mapping, evidence collection, OSCAL outputs, and associated risk management needs.

FedRAMP Certification & Continuous Compliance

• Document the Cloud Service Offering (CSO) for 20x certification, including the production environment, data plane and data flows, management plane, security controls plane, and in‑scope supporting services. As applicable, reconcile the proposed FedRAMP boundary against the most recent SOC 2 report’s scope.

• Complete gap assessment(s) and build capability to deliver all mandatory 20x KSIs, ensuring each has a correctly defined measure, an authoritative evidence source, an accountable owner, and a documented “Meets” status.

• Design and build the FedRAMP Trust Center, Security Inbox, and a machine‑readable KSI evidence pipeline, normalizing signals from CSPM, IAM, SIEM, CI/CD, and vulnerability‑scanning tools so certification data is generated from live systems rather than manually…