Principal GCO Compliance Systems Advisor

Position: Principal GCO High Compliance Systems Advisor
About Mimecast The work people build is worth protecting, and it's harder to protect than it used to be. AI agents now move at machine speed with human-level access, and a small slip-up can become a very public one. We disrupt cybercriminal activity before that happens. We think fast, go big, and always demand more of ourselves. We work hard, deliver, and repeat.

We grow with real determination and put success well within reach. We push each other to be better and expect to be pushed back, in a community built on respect, where everyone is counted.

Work Protected.

Overview Mimecast's Governance and Certification Office (GCO) is looking for a Principal GCO High Compliance Systems Advisor to own its high-compliance certification program, including FedRAMP authorization, lead technical control design and documentation, and manage third-party risk management (TPRM).The GCO oversees regulatory, governance, certification, and third-party risk assurance across Mimecast's multi-jurisdictional SaaS security business. You'll partner with Engineering, Security, Legal, Product, and departmental subject matter experts to keep controls and evidence audit-ready.

You'll also represent Mimecast in mandatory sessions with clients, assessors, and regulators.

You'll report to the SVP / Head of GCO. This role can be based in the Minneapolis, Columbus, or Lexington offices on a hybrid  your first 12 months, success means keeping FedRAMP Moderate authorization activities on schedule without a continuity gap during the transition; maintaining current, consistent control documentation mapped across active certification frameworks; establishing a defined TPRM cadence with clear remediation ownership;

and building trusted relationships with Engineering, Security, and Product subject matter experts.

What You'll DoOwn end-to-end FedRAMP authorization activity, including control design, documentation (SSP, POA&Ms, and control narratives), and evidence collection.

Chair mandatory FedRAMP meetings, including kick-offs, control walkthroughs, and readiness and assessment sessions with third-party assessment organizations (3

PAOs), agency sponsors, and client stakeholders.

Draft, review, and maintain technical control documentation across the certification portfolio, ensuring accuracy, consistency, and audit traceability.

Work with Engineering, IT Security, Product, and Infrastructure subject matter experts to translate technical implementations into assessor-ready control narratives.

Maintain the control evidence library and mappings across FedRAMP, ISO, SOC 2, and NIST frameworks to reduce duplicate evidence requests.

Report program risks, milestones, and open items to GCO leadership, escalating blockers that need cross-functional sponsorship.

Monitor emerging federal and commercial assurance regimes and assess their implications for Mimecast's certification roadmap.

What You'll Bring Experience leading a FedRAMP Rev 5 Moderate impact-level authorization, including chairing all mandatory client and regulator meetings, designing technical controls, and preparing the full documentation set: SSP, control implementation summaries, and POA&Ms.Extensive experience drafting, reviewing, and maintaining technical control documentation in partnership with departmental subject matter experts, ensuring control descriptions accurately reflect implementation.

Ability to contribute your own subject matter expertise while aligning Engineering, Security, Legal, and Product teams around a shared documentation position.

Confidence presenting to external assessors, regulators, and client security teams under scrutiny.

A structured approach to maintaining detailed, cross-referenced evidence libraries while keeping the broader risk picture in view.

Ab…