Mimecast
Mimecast
1,001 – 5,000 Employees
H1B Visa SponsorCybersecuritySecurity
Mimecast is a cybersecurity company that helps organizations address persistent digital threats through security services designed around privacy, resilience, and user experience. Its team of more than 2,500 employees works across international markets, including the United States, the United Kingdom, and Australia. The company emphasizes anticipating emerging risks, strengthening protection over time, and maintaining a culture focused on security excellence and continuous improvement.

Principal FedRAMP Compliance Systems Advisor

Lead Mimecast’s FedRAMP authorization, technical controls, and third-party risk programs. Work across cybersecurity, engineering, legal, and product teams at a SaaS security company.

Description

  • Lead FedRAMP authorization from control design and documentation through evidence collection.
  • Facilitate required FedRAMP meetings with 3PAOs, agency sponsors, and client stakeholders.
  • Prepare, review, and maintain technical control documentation across certification programs.
  • Turn technical implementations into assessor-ready control narratives with Engineering, IT Security, Product, and Infrastructure experts.
  • Build and mature third-party risk management, including vendor tiering, due diligence, monitoring, and remediation tracking.
  • Manage control evidence and framework mappings for FedRAMP, ISO, SOC 2, and NIST.
  • Update GCO leadership on risks, milestones, and open items, escalating blockers as needed.
  • Track emerging federal and commercial assurance frameworks and evaluate their effect on Mimecast’s certification plans.
  • Represent Mimecast in required meetings with clients, assessors, and regulators.
  • Work with Engineering, Security, Legal, Product, and other subject matter experts to keep controls and evidence ready for audits.

Requirements

  • Have led a FedRAMP Rev. 5 Moderate authorization, including required client and regulator meetings, technical control design, and preparation of the SSP, control implementation summaries, and POA&Ms.
  • Bring extensive experience drafting, reviewing, and maintaining technical control documentation with subject matter experts.
  • Be able to align Engineering, Security, Legal, and Product teams on shared documentation.
  • Present confidently to external assessors, regulators, and client security teams.
  • Maintain detailed, cross-referenced evidence libraries.
  • Work independently as regulatory guidance evolves, including FedRAMP 20x.
  • Have experience auditing controls for ISO 27001, SOC 2, and other security certification programs.
  • Manage external auditor relationships and resolve findings.
  • Have hands-on FedRAMP 20x preparation under the CR26 framework, ideally covering Classes A–C, automatic control monitoring, KSIs, and tools such as Paramify.
  • Be familiar with GRC and compliance tools such as Drata and Responsive.
  • Know NIST 800-53, CIS Controls, and CSA STAR / CCM.
  • Have experience in a private equity-backed or IPO-track environment.
  • Have exposure to enterprise risk frameworks such as bowtie methodology.
  • Bring project management experience running certification programs spanning multiple months and teams.
  • Write clearly and effectively about technical topics.
  • Successfully complete applicable background checks.

Benefits

  • Benefits are offered.
  • May be eligible for incentive plans.
  • Additional benefits are provided under company policy and applicable local regulations.
  • Mimecast is an Equal Opportunity and Affirmative Action Employer.
  • Interview adjustments or accommodations are available for disabilities or other reasons.

Related Jobs

CVS Health

CVS Health Business Compliance Manager, Requests for Information

CVS Health

Oversee regulatory information requests across CVS Health operations and jurisdictions. Lead analysts and coordinate compliant responses with Legal, Compliance, and Operations.

Open
Johnson & Johnson

Senior Manager, Regulatory Affairs – Biomaterials | Johnson & Johnson

Johnson & Johnson

Lead regulatory strategy for biomaterials, biologics, and combination products at Johnson & Johnson Orthopaedics. Guide submissions, external innovation reviews, and global approvals from development through product lifecycle management.

Open