OverviewMimecast's Governance and Certification Office (GCO) is looking for a Principal GCO High Compliance Systems Advisor to own its high-compliance certification program, including FedRAMP authorization, lead technical control design and documentation, and manage third-party risk management (TPRM).
The GCO oversees regulatory, governance, certification, and third-party risk assurance across Mimecast's multi-jurisdictional SaaS security business. You'll partner with Engineering, Security, Legal, Product, and departmental subject matter experts to keep controls and evidence audit-ready. You'll also represent Mimecast in mandatory sessions with clients, assessors, and regulators.
You'll report to the SVP / Head of GCO. This role can be based in the Minneapolis, Columbus, or Lexington offices on a hybrid model.
In your first 12 months, success means keeping FedRAMP Moderate authorization activities on schedule without a continuity gap during the transition; maintaining current, consistent control documentation mapped across active certification frameworks; establishing a defined TPRM cadence with clear remediation ownership; and building trusted relationships with Engineering, Security, and Product subject matter experts.
What You'll Do- Own end-to-end FedRAMP authorization activity, including control design, documentation (SSP, POA&Ms, and control narratives), and evidence collection.
- Chair mandatory FedRAMP meetings, including kick-offs, control walkthroughs, and readiness and assessment sessions with third-party assessment organizations (3PAOs), agency sponsors, and client stakeholders.
- Draft, review, and maintain technical control documentation across the certification portfolio, ensuring accuracy, consistency, and audit traceability.
- Work with Engineering, IT Security, Product, and Infrastructure subject matter experts to translate technical implementations into assessor-ready control narratives.
- Maintain the control evidence library and mappings across FedRAMP, ISO, SOC 2, and NIST frameworks to reduce duplicate evidence requests.
- Report program risks, milestones, and open items to GCO leadership, escalating blockers that need cross-functional sponsorship.
- Monitor emerging federal and commercial assurance regimes and assess their implications for Mimecast's certification roadmap.
What You'll Bring- Experience leading a FedRAMP Rev 5 Moderate impact-level authorization, including chairing all mandatory client and regulator meetings, designing technical controls, and preparing the full documentation set: SSP, control implementation summaries, and POA&Ms.
- Extensive experience drafting, reviewing, and maintaining technical control documentation in partnership with departmental subject matter experts, ensuring control descriptions accurately reflect implementation.
- Ability to contribute your own subject matter expertise while aligning Engineering, Security, Legal, and Product teams around a shared documentation position.
- Confidence presenting to external assessors, regulators, and client security teams under scrutiny.
- A structured approach to maintaining detailed, cross-referenced evidence libraries while keeping the broader risk picture in view.
- Ability to work independently with evolving regulatory guidance, including FedRAMP 20x, and translate it into a workable internal plan.
- Experience auditing controls for ISO 27001, SOC 2, and other security certification schemes, managing external auditor relationships, and closing findings.
- Hands-on preparation for FedRAMP 20x under the CR26 framework, ideally spanning Classes A-C, including automatic control monitoring, Key Security Indicators (KSIs), and supporting technologies such as Paramify.
- Familiarity with GRC and compliance tools such as Drata and Responsive.
- Working knowledge of NIST 800-53, CIS Controls, and CSA STAR / CCM, including how they map to FedRAMP and ISO control sets.
- Experience in a PE-backed or IPO-track environment where governance evidence must support regulatory requirements and investor due diligence.
- Exposure to enterprise risk frameworks, such as bowtie methodology, to explain control gaps as business risks to non-technical stakeholders.
- Project management experience running multi-month, cross-functional certification programs with competing deadlines.
- Strong technical writing skills, turning complex control details into clear, assessor-ready narratives.
The base salary range for this position is 132,000 - 198,000 USD plus benefits. This range represents the minimum and maximum new hire compensation for this role. The position may also be eligible for incentive plans and additional benefits, in accordance with company policy and local regulations. Our salary ranges are determined by role, level, and location with individual compensation also dependent on factors such as qualifications, experience, and skills. Final offers will reflect these considerations and may vary accordingly.
