# Security Compliance Program Manager

**Company:** [Kaizen Labs](https://hotfix.jobs/companies/kaizen-labs)
**Location:** New York, NY, Washington, DC
**Role:** Business Operations
**Salary:** $198k – $291k/yr
**Skills:** FedRAMP, fedramp 20x, nist 800-171, nist 800-53, sprs, piee, cmmc, poa&m, oscal, dod cloud computing srg, dfars, far, ssp, fcl
**Posted:** 2026-08-10

> Owns hands-on federal security compliance operations across FedRAMP 20x, DoD Impact Levels, and CMMC, producing authorization artifacts, assessments, POA&Ms, and federal submissions. Requires direct SPRS and PIEE experience, end-to-end NIST assessment ownership, assessor collaboration, and federal or defense contracting experience.

## Job Description

## Responsibilities
- Build and maintain a federal compliance obligation register covering contracts, subcontracts, FAR and DFARS flowdowns, regulatory requirements, training, reporting, prohibited technology, and organizational conflicts of interest.
- Establish monthly POA&M processes, obligation calendars, named owners, and escalation paths.
- Run the NIST 800-171 self-assessment, calculate and maintain the SPRS score, stage the senior-official affirmation, and maintain dated POA&M entries.
- Manage FedRAMP 20x authorization operations, including control implementation status, inherited/shared/application-specific controls, POA&M currency, continuous monitoring, Key Security Indicators, machine-readable packages, marketplace status, and evidence exchange with the independent assessor.
- Maintain DoD Impact Level reciprocity mappings, review hosting-platform authorization coverage, and establish control-responsibility matrices.
- Maintain a corporate CUI system security plan separate from product SSPs.
- Assemble certification applications and federal paperwork, including DD Form 2345, JCP registration, DD 254, PIEE, SPRS, SAM.gov, and FCL readiness materials.
- Write and operationalize configuration management, incident response, contingency, and supply chain risk management plans.
- Document continuous monitoring and log retention and answer agency security questionnaires.
- Work independently as the primary compliance owner with engineering, advisors, assessors, and company leadership.

## Requirements
- Direct experience submitting through federal portals, specifically SPRS and PIEE.
- End-to-end ownership of a NIST 800-171 self-assessment or RMF package.
- Ability to explain the 110-control SPRS scoring basis, weighting, and the impact of POA&M entries.
- Hands-on experience with NIST 800-53 Rev. 5 in a real SSP.
- Current, practical knowledge of FedRAMP 20x, including Certification Classes, Key Security Indicators, machine-readable packages, and continuous validation.
- Understanding of Rev. 5 processes, including significant-change requests.
- Working knowledge of the DoD Cloud Computing SRG and Impact Levels.
- Experience working with a 3PAO or independent assessor.
- Ability to interpret FAR and DFARS flowdowns and create an obligation register.
- Federal or defense contracting experience.
- US person eligible for a Tier 3 background investigation.

## Nice-to-Haves
- Owned a FedRAMP authorization through completion on the provider or assessor side.
- Experience writing OSCAL or establishing a trust center against live control indicators.
- Military background in security, intelligence, or information security.
- CMMC CCP or RP certification.
- Experience with eMASS, Xacta, or Paramify.
- Knowledge of the GovRAMP reciprocity path into FedRAMP Class A.
- Prior contract-engagement experience in this type of compliance work.

## Compensation
- Contract engagement with a salary range of $197,600–$291,200 annually.

## Similar roles

- [Executive Business Partner](https://hotfix.jobs/jobs/c8a74e53-7489-4900-9cac-60a85007ba4c) - Thinking Machines Lab - New York, NY - $200k – $250k/yr
- [Founding AI Transformation Strategist](https://hotfix.jobs/jobs/33ee9e23-194c-4d8e-b21a-5153ce0a38f7) - Scribe - San Francisco, CA - $200k – $260k/yr
- [Strategy & Operations, Product Partnerships](https://hotfix.jobs/jobs/85e0a5ae-3375-4c33-9712-0dfab16c595a) - Anthropic - San Francisco, CA - $205k – $240k/yr
- [Business Systems Analyst](https://hotfix.jobs/jobs/a35b29bc-a44b-44f5-a87e-5b425f9e8a89) - Anthropic - San Francisco, CA - $205k – $270k/yr
- [Global Public Policy Manager, Compute, Infrastructure & Sovereign AI](https://hotfix.jobs/jobs/79188abb-7599-4ae9-8032-5c13ea5c7473) - Cohere - Remote - $190k – $230k/yr

**Apply:** https://hotfix.jobs/jobs/ef2dcee0-2b63-458b-9b4a-256e715f7274
**Canonical:** https://hotfix.jobs/jobs/ef2dcee0-2b63-458b-9b4a-256e715f7274