Information Systems Security Manager

The Information Systems Security Manager (ISSM), FedRAMP is responsible for overseeing and sustaining the security authorization and continuous compliance of cloud-based information systems supporting United States Federal Government customers. This role is accountable for ensuring the confidentiality, integrity, availability, privacy, auditability, and accountability of government information systems and associated data.

The ISSM partners closely with Business Operations, Engineering, R&D, Product, Legal, and Information Security leadership to ensure information systems deliver required business functionality while being designed, implemented, and maintained in accordance with FedRAMP, NIST SP 800-53, the NIST Risk Management Framework (RMF), and all applicable federal and agency-specific requirements.

This position owns overall FedRAMP strategy, authorization execution, continuous monitoring, and Authority to Operate (ATO) sustainment, ensuring ongoing compliance and continuous audit readiness throughout the system lifecycle. In addition, the role supports broader Government (GOV) system security and compliance activities, helping ensure consistent governance and adherence to regulatory requirements across all in-scope federal and state environments. Responsibilities Manage and oversee end-to-end FedRAMP authorization activities, including planning, execution, resourcing, and stakeholder coordination.

• Own the development, maintenance, and quality of all FedRAMP-required security documentation, including the System Security Plan (SSP), Security Assessment Plan (SAP), Security Assessment Report (SAR), Plan of Action & Milestones (POA&M), and Continuous Monitoring artifacts.
• Oversee monthly POA&M management, including vulnerability prioritization, remediation tracking, and risk acceptance coordination.
• Lead and coordinate independent security control assessments, vulnerability management, penetration testing, contingency plan testing, and other required security activities.
• Direct FedRAMP Continuous Monitoring (ConMon) activities, ensuring timely and accurate submission of monthly, quarterly, and annual deliverables, including scan results, incident reports, and compliance attestations.
• Serve as the primary point of contact for sponsoring agencies, 3PAOs, and internal stakeholders on all FedRAMP-related matters.
• Oversee research and response efforts related to government security bulletins, vulnerability advisories, and federal data calls, ensuring timely and accurate responses.
• Ensure accurate and up-to-date system, software, and hardware inventories for government-authorized environments.
• Provide strategic guidance on secure cloud architecture and compliance-driven design decisions across AWS, Azure, and/or GCP environments.
• Evaluate system changes for FedRAMP impact and ensure adherence to change management, configuration management, and incident response requirements.
• Interpret evolving FedRAMP, NIST, and agency-specific requirements and translate them into actionable guidance for technical and business teams.
• Coach and educate internal teams on FedRAMP obligations, audit expectations, and security best practices.
• Identify and implement process improvements to enhance compliance efficiency, reduce risk, and strengthen audit readiness.
• Develop and deliver status reporting and metrics to leadership on authorization posture, risk exposure, and overall compliance health.
• Complete all responsibilities as outlined in the annual performance review and/or goal setting.
• Complete all special projects and other duties as assigned.
• Must be able to perform duties with or without reasonable accommodation.

• 8+ years of information security, risk, or compliance experience, including interaction with senior leadership, auditors, and regulators.
• Demonstrated experience leading or managing FISMA Moderate or High authorizations and ongoing ATO maintenance.
• Strong working knowledge of FedRAMP framework, NIST SP 800-53, and NIST RMF
• Experience managing SSPs, POA&Ms, vulnerability remediation, audits, and Continuous Monitoring programs.
• Hands-on experience with cloud service providers (AWS, Azure, GCP) and SaaS environments.
• Proven ability to lead cross-functional initiatives across technical and non-technical team.
• Excellent written and verbal communication skills, with the ability to translate complex regulatory requirements for varied audiences.
• Strong organizational skills and ability to prioritize effectively in a highly regulated environment.
• Security or compliance certifications (CISSP, CISM, Security+, AWS/Azure Security certifications).

Cognitive/Mental Requirements:

• Communicating with others to exchange information.
• Problem-solving and thinking critically.
• Completing tasks independently.
• Interpreting data.
• Making timely decisions in the context of a workflow.
• Maintaining focus.
• Assessing the accuracy, neatness and thoroughness of the work assigned.
• Learning new tasks and completing tasks in situations that have a speed or productivity quota.
• Remembering and adhering to processes and protocols.
• Applying established protocols in a timely manner.

Working Conditions and Physical Requirements:

• Must be able to provide high-speed internet access / connectivity and office setup and maintenance.
• Remaining in a stationary position, often standing or sitting for prolonged periods.
• Repeating motions that may include the wrists, hands and/or fingers.
• Must be able to provide a dedicated, secure work area.
• Must be able to provide high-speed internet access / connectivity and office setup and maintenance.
• No adverse environmental conditions expected.

Base compensation ranges from $135,000 to $155,000 per year. Specific offers are determined by various factors, such as experience, education, skills, certifications, and other business needs. This role is eligible for discretionary bonus consideration.

Cotiviti offers team members a competitive benefits package to address a wide range of personal and family needs, including medical, dental, vision, disability, and life insurance coverage, 401(k) savings plans, paid family leave, 9 paid holidays per year, and 17-27 days of Paid Time Off (PTO) per year, depending on specific level and length of service with Cotiviti. For information about our benefits package, please refer to our Careers page.