FedRAMP Program Manager
No salary listed
Senior
Remote in USA
Remote
Risk & ComplianceRegulatory Compliance & Ethics
No H1B Sponsorship
US Citizenship Required
About the job
Requirements
- At least 7 years of relevant professional experience in security, compliance, technical program management, risk management, cloud security, or related disciplines, including at least 3 years of direct FedRAMP program execution or ownership experience.
- Demonstrated ownership of a substantial portion of at least one FedRAMP authorization lifecycle, including readiness or gap assessment, control implementation and evidence readiness, assessment support, findings or POA&M remediation, authorization activities, and transition into continuous monitoring.
- Experience operating a FedRAMP program after authorization, including continuous monitoring, recurring evidence collection, remediation deadlines, scope or significant-change considerations, and assessment preparation.
- Strong working knowledge of NIST SP 800-53 and the FedRAMP Moderate baseline, including controls, implementation statements, control inheritance, shared responsibility, assessment findings, and evidence requirements.
- Experience operating within cloud or compliance shared-responsibility models, including identifying control ownership, inherited versus customer responsibilities, evidence dependencies, and gaps between provider and customer obligations.
- Ability to translate FedRAMP requirements into actionable expectations, owners, deadlines, evidence requirements, and acceptance criteria for technical and non-technical teams.
- Experience evaluating whether evidence and remediation responses adequately address stated control requirements or findings, including the judgment to reject inadequate company submissions before external review.
- Ability to drive remediation and compliance commitments across Software Engineering, Cloud or Platform Engineering, IT, Security, Support, Product, and other teams without direct management authority.
- Working technical knowledge of SaaS and cloud environments, including identity and access management, CI/CD and deployment paths, vulnerability management, logging and monitoring, system boundaries, encryption, change management, software dependencies, and cloud infrastructure.
- Ability to recognize when specialized technical validation is required and engage appropriate subject-matter experts rather than serving as the hands-on implementer.
- Ability to independently establish program structure, determine next actions from regulatory and partner requirements, resolve ambiguous ownership, establish priorities and deadlines, and escalate matters requiring management, risk-owner, partner, or technical-specialist decisions.
- Experience leveraging AI-enabled tools, automation, or other advanced systems to improve productivity, analysis, and program execution, with judgment in validating outputs and determining when human or subject-matter-expert review is required.
- Strong written and verbal communication skills, including the ability to communicate requirements, deficiencies, risk, program status, and decisions clearly to engineers, business stakeholders, external partners, assessors, and leadership.
- Must be a U.S. Person and reside in the United States.
Responsibilities
- Own day-to-day execution of the company side of the FedRAMP program, including milestones, dependencies, risks, deadlines, and internal follow-through.
- Translate FedRAMP requirements, findings, partner requests, and service-level commitments into internal actions with owners, due dates, evidence expectations, and acceptance criteria.
- Maintain an authoritative view of program status and identify work that may threaten assessment, remediation, continuous-monitoring, or other FedRAMP deadlines.
- Assess overall program readiness and identify systemic gaps in controls, evidence, ownership, processes, or dependencies that could jeopardize FedRAMP objectives.
- Determine next actions, establish priorities and deadlines, resolve routine program and ownership issues, and escalate material risks, disputed requirements, risk-acceptance decisions, missed commitments, or matters requiring management, partner, or specialized technical intervention.
- Use approved AI-enabled tools and automation to improve program activities while validating outputs against authoritative requirements and program context.
- Coordinate implementation and ongoing operation of organizational and procedural controls retained by the company with appropriate internal control owners.
- Coordinate company inputs into partner-managed FedRAMP records, including control narratives, evidence, remediation information, and other required documentation.
- Collect and review evidence for completeness, accuracy, relevance, currency, traceability to applicable controls or findings, and consistency with FedRAMP and partner requirements before submission.
- Act as the company-side quality gate for evidence and remediation responses by rejecting incomplete or inadequate submissions and requiring correction before external submission.
- Track findings from initial assessments, continuous monitoring, and other authorized testing through assignment, remediation, evidence submission, and closure.
- Establish internal remediation deadlines based on external deadlines, service-level requirements, risk, and program dependencies.
- Serve as the primary operational interface with the external FedRAMP infrastructure and compliance partner.
- Participate in partner-led continuous-monitoring meetings and communicate, assign, track, and complete resulting actions, findings, requests, and decisions internally.
- Work with Software Engineering and Cloud Engineering to communicate technical compliance requirements, remediation expectations, deadlines, and required evidence without performing technical remediation directly.
- Coordinate with Security, IT, Support, Operations, Product, Legal, and leadership on organizational controls, process changes, customer or contractual considerations, and other FedRAMP obligations.
- Drive commitments across teams that do not report directly to the role through clear requirements, follow-through, escalation, and accountability.
- Engage technical or functional subject-matter experts when specialized validation is required and reflect their conclusions in the program record.
- Maintain clarity over FedRAMP-in-scope users, systems, workflows, integrations, organizational processes, control inheritance, and shared-responsibility boundaries.
- Maintain understanding of obligations retained by the company versus those operated, inherited, or evidenced by external partners.
- Coordinate review of product, infrastructure, operational, or process changes that may affect FedRAMP scope, documented behavior, or control responsibilities.
- Coordinate delivery and maintenance of required compliant system artifacts, including the approved operating-system image, by responsible engineering and implementation teams.
- Identify gaps or ambiguity in responsibility between the company and external partners and drive resolution before they create compliance or delivery risk.
- Recommend program priorities and corrective actions based on FedRAMP requirements, organizational readiness, risk, external dependencies, and authorization objectives.
- Provide FedRAMP subject-matter input to Product, Legal, and other stakeholders, distinguishing documented requirements from partner preferences, interpretation questions, and internal risk decisions.
- Continuously improve FedRAMP processes, documentation, evidence practices, ownership models, and operating routines to create a sustainable and repeatable compliance program.
- Provide decision-ready reporting to the Director of Security and Compliance on program status, deadlines, findings, remediation progress, evidence quality, partner dependencies, and material risks.
- Escalate early when deadlines, requirements, quality failures, ownership issues, or external dependencies require management or executive intervention.
- Identify decisions requiring management, risk-owner, partner, legal, or specialized technical input.
Desired Qualifications
- At least 5 years of direct FedRAMP program execution experience and/or experience owning multiple authorization lifecycles.
- Experience independently leading company-side execution through a FedRAMP authorization lifecycle, including establishing program structure, driving organizational readiness, coordinating assessment activities, and transitioning into continuous monitoring.
- Experience operating in a fully self-managed FedRAMP environment, particularly for a SaaS or cloud software provider.
- Experience in a partner-managed FedRAMP implementation where the candidate owned company-side execution, evidence quality, remediation tracking, control ownership, and shared-responsibility coordination.
- Experience working directly with FedRAMP assessors, 3PAOs, agency or authorization stakeholders, managed hosting providers, or other external authorization and compliance partners.
- Experience supporting FedRAMP scope, authorization-boundary, significant-change, change-management, or continuous-monitoring decisions in a SaaS or cloud environment.
- Experience coordinating remediation of security findings across software engineering, cloud or platform engineering, IT, and security teams without serving as the hands-on implementer.
About the company
Agiloft provides contract and commerce lifecycle management software that helps organizations create, negotiate, execute, manage, and renew contracts. Delivered as a SaaS platform available in cloud or on premises, it emphasizes rapid deployment and heavy customization without extensive coding. Compared with competitors, it stands out for high configurability, fast setup, and an unconditional guarantee on both software and implementation costs. Its goal is to help organizations streamline contract processes, ensure compliance, and accelerate value from their agreements.
Company Size
201-500
Company Stage
Growth Equity (Venture Capital)
Total Funding
$45M
Headquarters
Redwood City, California
Founded
1991
Get referred to Agiloft
See people who can refer or advise you
Simplify's Take
What believers are saying
- More than 50% of Agiloft ARR customers licensed AI by January 27, 2026.
- Astra GA on July 14, 2026 removed waitlists and added unlimited-user free access.
- Agiloft reported 12x application usage growth and 250% AI-user growth since November 2025.
What critics are saying
- Salesforce Agentforce can bundle native contracting features and compress Agiloft’s integration moat in 2026.
- Icertis and Ironclad attack the same enterprise CLM budgets, slowing new-logo wins.
- Free Astra pricing trains buyers to expect low-cost CLM, crushing ACVs and margin expansion.
What makes Agiloft unique
- Agiloft’s no-code CLM deploys inside Salesforce via AgentExchange on August 20, 2026.
- Astra combines contract AI, redlining, and portfolio analysis on customers’ own contract data.
- Jason Barnwell’s June 2026 CPO move fuses Microsoft-scale legal operations with product design.
Help us improve and share your feedback! Did you find this helpful?
Benefits
- Unlimited Paid Time Off
- Paid Holidays
- Wellness Program