Program Manager - FedRAMP (New York)
1 day ago
New York
Job Title: Program Manager Duration: 12+ Months (Possible extension) Location: Washington, DC 20005 Onsite Role (4 days a week) Responsibilities: • Seeking a seasoned Program Manager to lead the creation, authorization, and continuous governance of a FedRAMP-compliant Azure Government tenant underpinning government payment transaction services., • You will own the end-to-end program—system boundary definition, documentation, ATO readiness, and continuous monitoring—ensuring sustained compliance at FedRAMP High, • Own the multi-year FedRAMP roadmap for an Azure Government tenant supporting government transactions; define milestones, risks, dependencies, and decision gates., • Establish governance forums and operating mechanisms across engineering, cloud platform, information security, risk/compliance, legal, payment operations, and 3PAOs., • Maintain program OKRs/KPIs: POA&M closure velocity, control coverage, vulnerability SLAs, ConMon completeness, audit readiness, and, • Drive disciplined change control, evidence management, , and control attestation workflows aligned to FedRAMP requirements., • Lead authoring and maintenance of FedRAMP artifacts: SSP and associated FedRAMP appendices, POA&M, policies/standards/procedures, boundary diagrams, and data flows tailored to Azure Government/GCC High constructs., • Define and maintain the system boundary and data categorization supporting payment transactions; align to FedRAMP High baseline., • Coordinate control implementation across all FedRAMP control families., • Stand up and run Continuous Monitoring, in alignment with FedRAMP High guidelines, for the Azure Government tenant: scanning cadence, patch cycles, configuration baseline monitoring, control effectiveness checks, incident handling, and change compliance., • Own POA&M lifecycle: triage findings, prioritize by risk, execute corrective actions, validate closure, reporting outstanding actions, and update artifacts., • Maintain a program risk register spanning control gaps, architectural changes, data flows, vendor dependencies, and operational risks in payment services., • Escalate issues with quantified impact; drive compensating controls or risk acceptance decisions in partnership with risk/compliance. Education/Experience: • Bachelor’s degree in Information Security, Computer Science, Information Systems, or related field; equivalent experience considered., • 7+ years of program management in regulated cloud environments; 3+ years directly owning FedRAMP programs, artifacts, and Continuous Monitoring., • Hands-on oversight, authorship, maintenance, and response experience with SSP, POA&M, SAP/SAR; proven track record achieving/maintaining ATO for cloud services., • Deep knowledge of NIST SP 800-53 control families, FedRAMP Moderate/High baselines, ConMon processes, and 3PAO engagements., • Strong familiarity with Azure Government or GCC High and core security capabilities: identity/access, logging/monitoring, encryption, policy enforcement, landing zone patterns., • Demonstrated success orchestrating cross-functional teams (security, cloud/platform, payments, operations, compliance, legal) to deliver complex regulatory programs. Preferred: • Direct experience enabling government payment transactions on cloud platforms and aligning control implementations to transactional risk profiles., • Azure-focused security experience (Defender for Cloud, Sentinel, Azure Policy/Blueprints, Key Vault, Private Link, Purview)., • Prior experience collaborating with federal agencies, sponsoring organizations, or authorizing officials for ATOs., • Experience with security compliance to IRS 1075 requirements, • Certifications: PMP, CISSP, CCSP, CISM, Azure Security Engineer Associate, or equivalent.