Fedramp Program Manager Jobs in Phoenix, AZ (NOW HIRING)

Full time

Hybrid Phoenix, AZ

About the Company

Founded in 1992, Mi-Case is the industry leader in fully integrated offender management software solutions and provides industry expertise and consulting within Criminal Justice and Public Safety systems. Mi-Case leverages a unique combination of technical, functional and industry specialization as well as partnerships with key software vendors to deliver maximum value add projects.

About the Role

The Chief Information Security Officer (CISO) is responsible for establishing and leading the enterprise-wide information security strategy, program, and governance across Mi-Case. Reporting directly to the CTO, the CISO serves as the senior-most authority on all matters related to cybersecurity, data protection, regulatory compliance, and risk management. This leader will build and mature Mi-Case's security posture in alignment with the specialized compliance requirements of the Criminal Justice and Public Safety sector, including CJIS 6.0, FedRAMP, ISO 27001, and SOC 2 frameworks. The CISO partners closely with executive leadership, product and engineering teams, and clients to ensure that security is embedded across the organization and that Mi-Case maintains the trust of the agencies and communities it serves.

Responsibilities

Security Strategy & Governance

• Develop, implement, and maintain a comprehensive enterprise information security strategy aligned with Mi-Case's business objectives and client commitments
• Establish and oversee the information security governance framework, policies, standards, and procedures across all business units
• Serve as the primary security advisor to the CEO, CTO, and executive leadership team; provide regular security briefings and risk reporting
• Evaluate and integrate AI-assisted security tools and practices to enhance threat detection, incident response, and security automation capabilities
• Define and track key security metrics, KPIs, security program maturity assessments, and risk indicators; present findings to leadership and the board of directors
• Own and manage the information security budget; develop annual budget plans and justify security investments to executive leadership and the board

Compliance & Regulatory

• Own and drive compliance with Criminal Justice Information Services (CJIS) Security Policy requirements, including leading the organization's transition to CJIS 6.0 compliance (phishing-resistant MFA, FIPS 140-3 encryption, updated cloud security controls), across all applicable products, systems, and operations
• Lead and maintain FedRAMP authorization and ongoing Continuous Monitoring (ConMon) efforts, including coordination with Third Party Assessment Organizations (3PAOs), federal agency sponsors, monthly vulnerability scanning, POA&M management, and annual assessments
• Maintain SOC 2 Type II compliance program; coordinate with external auditors and ensure continuous control effectiveness
• Own and maintain the ISO 27001 Information Security Management System (ISMS), including internal audit coordination, management reviews, risk treatment plans, and certification body engagement
• Ensure compliance with data privacy, data residency, and data sovereignty requirements applicable to justice and public safety clients
• Monitor evolving federal, state, and sector-specific regulatory requirements and ensure Mi-Case remains ahead of compliance obligations
• Oversee cyber insurance program; coordinate with legal counsel on security-related contractual obligations, breach response requirements, and regulatory reporting
• Serve as the primary point of contact for client security assessments, audits, and questionnaires
• Support sales engagements, RFP/RFI responses, and proactive security relationship-building with client CISOs and security teams

Incident Response & Threat Management

• Develop, maintain, and regularly test the enterprise incident response plan, including tabletop exercises and simulation drills
• Oversee or establish Security Operations Center (SOC) capabilities, including SIEM implementation, 24/7 monitoring, and continuous threat detection aligned with FedRAMP ConMon and CJIS requirements
• Lead the organization's response to security incidents, breaches, and threats; serve as the executive decision-maker during active incidents
• Oversee vulnerability management, penetration testing, and threat intelligence programs
• Manage relationships with external security partners, managed security service providers (MSSPs), and law enforcement contacts as needed
• Ensure timely and accurate breach notification processes in compliance with applicable laws and client contractual obligations

Security Awareness & Training

• Design and operate an enterprise-wide security awareness and training program that addresses role-specific risks and regulatory requirements
• Build a culture of security awareness across all departments, ensuring employees understand their responsibilities under CJIS, company policy, and client agreements
• Develop specialized training for technical staff, including secure coding practices, data handling, and AI tool usage governance
• Track training completion rates and measure program effectiveness; continuously improve content based on threat landscape changes

Architecture & Engineering Partnership

• Collaborate with product, engineering, and DevOps teams to ensure security-by-design principles are embedded in the software development lifecycle
• Review and approve security architecture for new products, features, and infrastructure changes
• Oversee identity and access management (IAM), encryption standards, and data classification frameworks, and data residency/sovereignty controls for government clients
• Oversee AWS cloud security posture, including AWS GovCloud environments, leveraging AWS security services (GuardDuty, Security Hub, CloudTrail, Config, KMS, WAF) and ensuring alignment with the AWS Shared Responsibility Model
• Manage software supply chain security, including Software Bill of Materials (SBOM), dependency vulnerability scanning, secure CI/CD pipeline controls, and code signing
• Own the application security (AppSec) program, including SAST/DAST/SCA tooling, secure code review standards, security release gates, and a responsible disclosure/vulnerability reporting process
• Ensure physical security controls for remote workers handling CJI, including compliance with CJIS 6.0 remote work requirements
• Define and drive adoption of Zero Trust architecture principles across the organization in alignment with federal mandates (OMB M-22-09)

Business Continuity & Disaster Recovery

• Develop, maintain, and regularly test business continuity and disaster recovery (BC/DR) plans in compliance with CJIS, FedRAMP (CP control family), and , and ISO 27001 (Annex A.17) requirements • Ensure BC/DR plans address CJI data protection, AWS infrastructure resilience, and client SLA commitments

Vendor & Third-Party Risk

Establish and manage a third-party risk management program, including vendor security assessments and contract security requirements

Ensure cloud service providers and technology partners meet Mi-Case's and clients' security standard

Educational and Training Requirements

• Bachelor’s degree in computer science, Information Security, Information Technology, or a related field required

• Master's degree preferred • Active security certifications required or expected within 12 months: CISSP, CISM, or equivalent

• CJIS Security Awareness Training certification required or obtainable within 90 days of hire

• Preferred certifications: CCSP (Certified Cloud Security Professional), AWS Certified Security — Specialty, CISA (Certified Information Systems Auditor), FedRAMP training/certification

Knowledge, Skills, and Abilities

• 10+ years of progressive information security experience, with at least 3–5 years in a senior security leadership role

• Deep knowledge of CJIS Security Policy (including version 6.0) and experience implementing compliant programs within a software or technology organization

• Demonstrated experience leading or maintaining FedRAMP Authorization to Operate (ATO) efforts and ongoing Continuous Monitoring (ConMon) programs

• Proven experience managing SOC 2 Type II compliance programs

• Strong understanding of security frameworks including NIST CSF, NIST 800-53, ISO 27001, and CIS Controls; experience implementing or maintaining an ISO 27001 ISMS strongly preferred

• Experience building and running incident response programs, including leading active incident management

• Proven ability to design and deliver effective security awareness and training programs across diverse audiences

• Experience evaluating and governing AI-assisted security tools; understanding of AI risk in a security context

• Excellent executive communication skills — ability to translate complex technical risk into clear business language for non-technical audiences

• Experience working in or with Criminal Justice, Public Safety, or Government sectors strongly preferred

• Deep understanding of CJIS Security Policy version 6.0, including phishing-resistant MFA, FIPS 140-3 encryption, and updated cloud computing security requirements • Experience securing AWS environments, including AWS GovCloud, and working knowledge of AWS security services (GuardDuty, Security Hub, IAM, KMS, CloudTrail, Config, WAF)

• Understanding of data privacy, data residency, and data sovereignty requirements for government clients, including PII/CJI lifecycle management

• Experience with cyber insurance programs and coordination with legal counsel on security matters, breach response, and contractual obligations

• Familiarity with Zero Trust architecture principles and federal Zero Trust mandates (OMB M-22- 09)

• Demonstrated ability to build and lead security teams and manage external security vendors and partner