Principal Technical Program Manager

• Stand up the Oracle Health Product Authorization FedRamp Team and define its charter, service model, roles, intake and prioritization process, governance cadences, quality standards, metrics, and escalation paths.

• Own the multi-year FedRAMP authorization and certification roadmap for assigned cloud offerings, including scope, sequencing, authorization-path recommendations, dependencies, reuse opportunities, investment needs, and transition to continuous assurance.

• Establish a scalable assessment operating model for readiness reviews, authorization-boundary definition, evidence planning, package development, 3PAO engagement, testing, findings management, remediation validation, and post-authorization monitoring.

• Partner with architecture and security-engineering teams to evaluate service boundaries, data flows, interconnections, multi-tenancy, identity, encryption, logging, resilience, supply-chain dependencies, control inheritance, and customer-responsible controls.

• Translate FedRAMP, NIST, and federal risk-management requirements into owned, testable, time-bound engineering and operational deliverables; set acceptance criteria for evidence, security decisions, and remediation plans.

• Design reusable evidence and assurance patterns using security telemetry, infrastructure as code, CI/CD controls, configuration validation, GRC workflows, machine-readable data, and automation where appropriate.

• Lead strategic engagement with 3PAOs, FedRAMP and agency stakeholders, federal customers, advisors, and critical suppliers; resolve escalations involving scope, testing, evidence, findings, or schedule.

• Drive material risks, findings, and plans of action through root-cause analysis, prioritization, remediation, validation, risk acceptance, and closure; ensure decisions are documented and traceable.

• Establish executive dashboards and operating reviews that show authorization readiness, critical-path dependencies, evidence quality, open findings, vulnerability and change posture, staffing needs, and decisions required.

• Embed authorization obligations into secure software delivery, vulnerability management, incident response, change management, configuration management, contingency planning, and cloud operations.

• Create a continuous-monitoring and ongoing-certification model that keeps authorization information current, supports required reporting, and enables agencies to make informed risk decisions.

• Mentor TPMs and security partners, publish playbooks and reusable patterns, and raise the organization's capacity to deliver federal authorizations consistently without weakening security outcomes.

Minimum Qualifications

• Bachelor's degree in Computer Science, Engineering, Information Systems, Cybersecurity, or a related discipline, or equivalent practical experience.

• Seven or more years of experience in technical program management, security program leadership, cloud delivery, compliance engineering, security engineering, or a related technology field, including responsibility for complex cross-organizational programs.

• Demonstrated experience leading an end-to-end FedRAMP certification or authorization, federal Authority to Operate, or comparably complex regulated cloud-assurance program from strategy or readiness through assessment, remediation, decision, and ongoing monitoring.

• Deep working knowledge of FedRAMP authorization and certification processes; NIST SP 800-53 Rev. 5; FIPS 199; federal risk management; control implementation and assessment; control inheritance; significant change; vulnerability management; remediation; and continuous monitoring.

• Strong technical understanding of SaaS and IaaS architecture, including authorization boundaries, multi-tenancy, identity and access management, network segmentation, encryption and key management, logging and monitoring, secure software delivery, resilience, and supply-chain dependencies.

• Demonstrated ability to define operating models, governance, roadmaps, metrics, and executive decision mechanisms across Security, Engineering, Product, Operations, Compliance, Legal, and business organizations.

• Experience assessing technical evidence and communicating concrete security requirements to engineering teams, including cloud configuration, vulnerability, identity, logging, encryption, change, and incident-response evidence.

• Experience leading engagements and resolving complex issues with independent assessors, agencies, authorizing stakeholders, federal customers, or comparable external oversight bodies.

• Exceptional written, verbal, and executive communication skills, including the ability to translate technical and regulatory complexity into clear business risk, investment choices, and recommendations.

• Proven ability to influence senior leaders and technical teams, resolve competing priorities, and drive accountable decisions without direct organizational authority.

Preferred Qualifications

• Experience establishing or materially scaling a FedRAMP, product authorization, GRC, security-assessment, or continuous-assurance function.

• Experience with multiple FedRAMP Moderate or High authorizations, FedRAMP 20x certifications, authorization reuse, or a portfolio of federal cloud services.

• Experience designing compliance-as-code, automated evidence, persistent validation, Security Decision Records, Key Security Indicators, or machine-readable assurance programs integrated with engineering systems.

• Experience with OSCAL, GRC platforms, cloud security posture management, infrastructure as code, CI/CD security, security data analytics, or automated control validation.

• Strong hands-on experience in cloud and platform security across OCI, AWS, Azure, or another hyperscale cloud platform; working familiarity with Kubernetes or container security is highly desirable.

• Relevant certifications such as CISSP, CCSP, CISM, CRISC, PMP, a cloud security certification, or equivalent demonstrated experience.

• Experience supporting U.S. federal customers or cloud services subject to federal security, privacy, records-management, or health-data requirements.