Lead Program Manager - FedRAMP

Accountabilities:: Own and manage the end-to-end federal compliance program within the Governance, Risk, and Compliance (GRC) function, with primary responsibility for FedRAMP Class D (High) and Department of Defense Impact Level 4 (IL4) requirements. Lead continuous monitoring activities, maintain System Security Plans (SSPs), coordinate evidence collection, and prepare mandatory compliance documentation and reporting. Plan, coordinate, and oversee security assessments, working closely with independent third-party assessors, agency Authorizing Officials, and internal control owners throughout the authorization process. Manage the identification, tracking, and resolution of assessment findings, control deficiencies, and compliance gaps, ensuring clear ownership, realistic deadlines, and documented closure evidence. Partner with Security, Engineering, and Product teams to translate complex federal security requirements into practical implementation guidance and evaluate the compliance impact of architectural changes, product features, and system integrations. Collaborate with technical stakeholders to assess and resolve issues involving system boundaries, inherited controls, and shared responsibility models across AWS GovCloud, internal services, and third-party dependencies. Communicate the organization's security and compliance posture, authorization status, and customer responsibilities clearly to federal agencies, external assessors, prospective customers, and internal leadership. Evaluate security and compliance requirements associated with prospective federal contracts, identifying potential risks, implementation requirements, and readiness considerations. Align federal security controls, policies, and supporting evidence with broader GRC initiatives, including CJIS, SOC 2, and applicable United Kingdom regulatory requirements. Monitor evolving federal security regulations and frameworks, incorporating new requirements into compliance strategies, program priorities, and operational processes. Provide regular updates to GRC leadership on program performance, compliance readiness, emerging risks, assessment progress, and remediation priorities. Drive cross-functional accountability and maintain strong collaboration across technical and operational teams to ensure sustainable compliance and continuous security improvement. Requirements: At least 7 years of professional experience in Governance, Risk, Compliance (GRC), cybersecurity, or security assurance, including substantial responsibility for federal compliance programs. Proven experience managing complex compliance initiatives within SaaS, cloud computing, or technology organizations, with direct involvement in security assessments, documentation, evidence collection, and remediation activities. Strong working knowledge of NIST Special Publication 800-53, including security control implementation, evidence validation, assessment preparation, and continuous compliance monitoring. Demonstrated experience maintaining security documentation, particularly System Security Plans (SSPs), coordinating independent assessments, and managing compliance findings through resolution. Solid technical understanding of cloud infrastructure, system architectures, security boundaries, inherited controls, and shared responsibility models. Ability to collaborate effectively with Engineering and Security teams to evaluate technical compliance decisions and translate regulatory requirements into actionable implementation guidance. Excellent communication and stakeholder management skills, with the ability to explain complex security and compliance topics to technical teams, executive leadership, external assessors, and government stakeholders. Strong project and program management capabilities, including the ability to operate independently, manage competing priorities, coordinate cross-functional commitments, and proactively escalate risks without relying on formal authority. Demonstrated analytical thinking, sound compliance judgment, and the ability to navigate ambiguity in evolving regulatory and technical environments. Must be a U.S. citizen due to the nature of the federal compliance responsibilities. Must be legally authorized to work in the United States without employer-sponsored visa support. Preferred: Direct, hands-on experience managing FedRAMP Moderate and/or High authorization programs, including SSP maintenance, continuous monitoring, and assessment coordination. Preferred: Experience supporting Department of Defense IL4 and/or IL5 security compliance requirements. Preferred: Practical experience with AWS GovCloud, particularly security control inheritance and cloud shared responsibility models. Preferred: Experience supporting federal agency authorization processes and evaluating security requirements for government contracts. Preferred: Experience aligning security controls and evidence across multiple frameworks, including CJIS, SOC 2, ISO 27001, and international public sector compliance standards. Preferred: Familiarity with Cybersecurity Maturity Model Certification (CMMC) and NIST SP 800-171. Strong interpersonal qualities, including humility, curiosity, openness to collaboration, and a systems-oriented mindset that connects security frameworks, technical environments, and business priorities. A proactive communication style and the ability to build trust, maintain stakeholder alignment, and foster a collaborative approach to compliance. Benefits: Fully remote working arrangements within the United States, subject to approved hiring locations. Full-time employment opportunity. Opportunity to work on high-impact federal security and compliance initiatives. Collaborative environment working alongside experienced professionals across Security, Engineering, Product, and GRC teams. Exposure to advanced cloud technologies, government security frameworks, and complex federal compliance programs. Opportunities to influence enterprise security strategy and contribute to the development of secure technology solutions supporting public safety and government organizations. Occasional business travel for team collaboration, internal meetings, or customer engagements. Access to office locations in New York City, Boston, and Manchester, UK, where applicable. The opportunity to contribute to a mission-driven organization focused on improving public safety and supporting communities through innovative technology.