Security Compliance Program Manager

Responsibilities

• Build and maintain a federal compliance obligation register covering contracts, subcontracts, FAR and DFARS flowdowns, regulatory requirements, training, reporting, prohibited technology, and organizational conflicts of interest.
• Establish monthly POA&M processes, obligation calendars, named owners, and escalation paths.
• Run the NIST 800-171 self-assessment, calculate and maintain the SPRS score, stage the senior-official affirmation, and maintain dated POA&M entries.
• Manage FedRAMP 20x authorization operations, including control implementation status, inherited/shared/application-specific controls, POA&M currency, continuous monitoring, Key Security Indicators, machine-readable packages, marketplace status, and evidence exchange with the independent assessor.
• Maintain DoD Impact Level reciprocity mappings, review hosting-platform authorization coverage, and establish control-responsibility matrices.
• Maintain a corporate CUI system security plan separate from product SSPs.
• Assemble certification applications and federal paperwork, including DD Form 2345, JCP registration, DD 254, PIEE, SPRS, SAM.gov, and FCL readiness materials.
• Write and operationalize configuration management, incident response, contingency, and supply chain risk management plans.
• Document continuous monitoring and log retention and answer agency security questionnaires.
• Work independently as the primary compliance owner with engineering, advisors, assessors, and company leadership.

Requirements

• Direct experience submitting through federal portals, specifically SPRS and PIEE.
• End-to-end ownership of a NIST 800-171 self-assessment or RMF package.
• Ability to explain the 110-control SPRS scoring basis, weighting, and the impact of POA&M entries.
• Hands-on experience with NIST 800-53 Rev. 5 in a real SSP.
• Current, practical knowledge of FedRAMP 20x, including Certification Classes, Key Security Indicators, machine-readable packages, and continuous validation.
• Understanding of Rev. 5 processes, including significant-change requests.
• Working knowledge of the DoD Cloud Computing SRG and Impact Levels.
• Experience working with a 3PAO or independent assessor.
• Ability to interpret FAR and DFARS flowdowns and create an obligation register.
• Federal or defense contracting experience.
• US person eligible for a Tier 3 background investigation.

Nice-to-Haves

• Owned a FedRAMP authorization through completion on the provider or assessor side.
• Experience writing OSCAL or establishing a trust center against live control indicators.
• Military background in security, intelligence, or information security.
• CMMC CCP or RP certification.
• Experience with eMASS, Xacta, or Paramify.
• Knowledge of the GovRAMP reciprocity path into FedRAMP Class A.
• Prior contract-engagement experience in this type of compliance work.

Compensation

• Contract engagement with a salary range of $197,600–$291,200 annually.