Head of Security Compliance – Authorization

Job not on LinkedIn

🔥 0 minutes ago

🦀 Maryland, Virginia – Remote

🦀 Maryland – Remote ⚔️ Virginia – Remote

💵 $200k - $215k / year

⏰ Full Time

🔴 Lead

🚔 Compliance

👻 Ghost score 10%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Second Front Systems

WebsiteLinkedInAll Job Openings

51 - 200 employees

☁️ SaaS

🎖️ Defense

🏛️ Government

SaaS • Defense • Government

Second Front Systems is a public-benefit, venture-backed company that provides mission-critical software solutions primarily to democracies around the world. Their product suite, which includes the 2F Suite, 2F Workshop, 2F Game Warden, and 2F Frontier, simplifies and accelerates the software development and delivery process. The company is trusted by leading software providers and government agencies for its secure DevSecOps solutions, enabling secure software deployment on classified and unclassified networks. Their offerings include tools for secure development, software accreditation, government cloud hosting, and edge deployment, particularly focused on supporting government and defense sectors. Second Front Systems collaborates with partners to make emerging technologies more accessible, accelerating the accreditation and compliance processes and offering solutions that can operate in remote or disconnected environments, such as drones and vehicles.

📋 Description

• Lead the Security Authorization and Compliance team • Establish the product security and compliance strategy for the Game Warden platform • Define ownership and operating processes for security authorization and continuous monitoring • Build a security roadmap covering capability gaps, investments, staffing, dependencies, and measurable outcomes • Provide leadership oversight for authorization packages supporting Department of Defense, federal, and national security environments • Maintain accurate and defensible authorization packages, control implementations, evidence, POA&Ms, and continuous monitoring activities • Establish standards and quality controls for eMASS packages, DISA PPSM registrations, assessment evidence, findings, and authorization documentation • Direct readiness for security assessments, third-party reviews, government audits, and authorization decisions • Own the corporate audit calendar • Integrate security requirements into product planning, architecture, releases, and engineering priorities • Track vulnerability and configuration findings against authorization and compliance impact • Review significant product and infrastructure changes for effects on controls, authorization boundaries, inherited services, customer commitments, and approvals • Coordinate compliance across DoD RMF, FedRAMP, CMMC, SOC 2, ISO standards, and other requirements • Establish reusable controls, shared evidence, common documentation, and cross-framework mappings • Expand automation for control validation, evidence collection, continuous monitoring, reporting, and authorization-package maintenance • Establish metrics for product risk, vulnerabilities, remediation, assessment readiness, POA&M health, authorization milestones, and capacity • Report material risks, program status, resource constraints, and decisions to the Vice President of Security and executive leadership • Manage vendors, assessment partners, penetration testing providers, and GRC technology investments • Coordinate with Security Operations and Incident Response when events affect authorizations or attestations • Work cross-functionally with Product, Engineering, Platform, Legal, and business leadership

🎯 Requirements

• 10+ years of progressive cybersecurity experience, including significant responsibility for product security, cloud security, security engineering, compliance, or government authorization programs • Five or more years of experience leading cybersecurity professionals • Experience owning security programs for a cloud platform, software-as-a-service product, platform-as-a-service environment, or similarly complex technology organization • Demonstrated success integrating security into product development and engineering workflows • Strong knowledge of application security, cloud security architecture, vulnerability management, secure software development, and software supply chain risk • Practical understanding of AWS, Kubernetes, containers, CI/CD pipelines, infrastructure as code, identity and access management, logging, observability, and cloud-native security patterns • Experience establishing or governing SAST, DAST, software composition analysis, secrets detection, container scanning, and penetration testing • Direct experience with NIST SP 800-53, NIST SP 800-37, DoD RMF, FedRAMP, or comparable federal requirements • Experience overseeing complex authorization packages and continuous monitoring • Familiarity with eMASS, DISA PPSM, DISA STIGs, SCAP Compliance Checker, ACAS, IAVM requirements, and DISA Cloud Computing Security Requirements Guide • Experience leading formal assessments with Security Control Assessors, third-party assessment organizations, government sponsors, and Authorizing Officials • Ability to evaluate technical risk and make sound decisions amid competing priorities • Strong written and verbal communication skills • Experience defining program metrics and presenting risk to senior leadership • Ability to build repeatable processes and operating structures • CISSP or equivalent advanced cybersecurity certification required • Must meet applicable DoD 8140 qualification requirements for the assigned work role • Active TS/SCI clearance or current eligibility preferred • Experience supporting DoD Impact Level 4 or Impact Level 5 cloud environments preferred • Experience leading FedRAMP Moderate or FedRAMP High programs preferred • Experience with Kubernetes-based DevSecOps platforms or multi-tenant cloud environments preferred • Familiarity with CMMC, SOC 2, ISO 27001, ISO 20000-1, Cyber Essentials Plus, or international security assurance requirements preferred • Experience with automated control testing, compliance as code, or continuous evidence collection preferred • Experience developing common control frameworks preferred • Experience managing third-party assessors, penetration testing providers, GRC platforms, and security technology vendors preferred • Advanced certifications such as CISM, CCSP, CSSLP, PMP, or CGRC preferred • Prior experience supporting national security, defense, intelligence, or highly regulated customers preferred • Candidates must reside in the DC/Maryland/Virginia hiring hub

🏖️ Benefits

• 100% employer-paid medical, dental, and vision coverage for you and your dependents • 401(k) with a 3% company contribution • Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more • Equity incentive plan • New hire technology and home office stipend • Annual professional development stipend • Flexible paid time off, plus all federal holidays • Generous parental leave • Flexible remote work opportunities • Employee referral bonus program • Potential eligibility for discretionary bonuses