• Lead the Security Authorization and Compliance team.
• Establish the product security and compliance strategy for Game Warden in alignment with the company’s business objectives, product roadmap, customer commitments, and enterprise security strategy.
• Define ownership and operating processes for security authorization and continuous monitoring, including the handoffs with Engineering and Security Operations.
• Build a security roadmap that identifies capability gaps, required investments, staffing needs, technical dependencies, and measurable outcomes.
• Provide leadership oversight for security authorization packages supporting Department of Defense, federal, and other national security environments.
• Ensure authorization packages, control implementations, assessment evidence, POA&Ms, and continuous monitoring activities remain accurate, current, and defensible.
• Establish the standards and quality controls used by Security Authorization Specialists to manage eMASS packages, DISA PPSM registrations, assessment evidence, findings, and authorization documentation.
• Direct readiness activities for security assessments, third-party reviews, government audits, and authorization decisions. Ensure teams address issues before they become assessment blockers.
• Own the corporate audit calendar.
• Partner with Engineering and Product leadership to integrate security requirements into product planning, architecture decisions, release processes, and engineering priorities.
• Track and report vulnerability/configuration findings against authorization and compliance impact of significant changes.
• Review significant product and infrastructure changes to determine their effect on security controls, authorization boundaries, inherited services, customer commitments, and existing approvals.
• Create a coordinated compliance approach across applicable frameworks, including DoD RMF, FedRAMP, CMMC, SOC 2, ISO standards, and other customer or market requirements.
• Reduce duplicate work by establishing reusable controls, shared evidence, common documentation, and cross-framework mappings.
• Expand the use of automation for control validation, evidence collection, continuous monitoring, compliance reporting, and authorization-package maintenance.
• Establish meaningful metrics for product risk, vulnerabilities, remediation performance, assessment readiness, POA&M health, authorization milestones, and program capacity.
• Provide the Vice President of Security and executive leadership with clear reporting on material risks, program status, resource constraints, and decisions requiring leadership attention.
• Manage relevant vendors, assessment partners, penetration testing providers, and GRC technology investments.
• Coordinate with Security Operations and Incident Response teams when events affect authorizations or attestations.

What You Bring

• Over 10 years of progressive cybersecurity experience, with significant responsibility for product security, cloud security, security engineering, compliance, or government authorization programs.
• More than five years of experience leading cybersecurity professionals, including success in setting priorities, developing talent, managing performance, and scaling teams.
• Experience owning security programs for cloud platforms, SaaS products, PaaS environments, or similarly complex technology organizations.
• Demonstrated success integrating security into product development and engineering workflows without unnecessary barriers to delivery.
• Strong knowledge in application security, cloud security architecture, vulnerability management, secure software development, and software supply chain risk.
• Practical understanding of AWS, Kubernetes, containers, CI/CD pipelines, infrastructure as code, identity and access management, logging, observability, and cloud-native security patterns.
• Experience establishing or governing application security capabilities such as SAST, DAST, software composition analysis, secrets detection, container scanning, and penetration testing.
• Direct experience with government security authorization programs, including NIST SP 800-53, NIST SP 800-37, DoD RMF, FedRAMP
• U.S. citizenship is required for this role.

Preferred

• Active TS/SCI clearance or current eligibility.
• Experience supporting DoD Impact Level 4 or Impact Level 5 cloud environments.
• Experience leading FedRAMP Moderate or FedRAMP High authorization and continuous monitoring programs.
• Experience with Kubernetes-based DevSecOps platforms or multi-tenant cloud environments supporting government customers.
• Familiarity with CMMC, SOC 2, ISO 27001, ISO 20000-1, Cyber Essentials Plus, or international security assurance requirements.
• Experience implementing automated control testing, compliance as code, or continuous evidence collection.
• Experience developing a common control framework that supports multiple authorization and certification programs.
• Experience managing third-party assessors, penetration testing providers, GRC platforms, and security technology vendors.
• Advanced certifications such as CISM, CCSP, CSSLP, PMP, or CGRC.
• Prior experience supporting national security, defense, intelligence, or other highly regulated customers.
• A strong commitment to Second Front Systems’ mission of accelerating the secure delivery of mission-critical software to the U.S. government.

The base salary for this position will fall between $200,000 and $215,000. Your ultimate compensation will be determined by professional background, technical proficiency, seniority, and regional cost factors. Furthermore, this opportunity includes potential eligibility for equity awards and discretionary bonuses, rounding out a comprehensive total rewards offering.

• A proactive and solutions oriented mindset
• Viewing obstacles as opportunities for growth
• Having a bias toward action and tangible, measurable results
• Being team-oriented with a focus on personal responsibility and autonomy

This role is a full time position. As a public benefit corporation, we’re a team of purpose-driven trailblazers transforming the future of U.S. national security. We hire the best to do their best and, as such, we are committed to providing the perks and benefits you need to be successful—both in- and outside the workplace.

• Competitive salary
• 100% employer-paid medical, dental, and vision coverage for you and your dependents
• 401(k) with a 3% company contribution
• Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more
• Equity incentive plan
• New hire technology and home office stipend
• Annual professional development stipend
• Flexible paid time off, plus all federal holidays
• Generous parental leave
• Flexible remote work opportunities
• Employee referral bonus program

Visit our careers page to learn more.

Second Front Systems (2F) is a public-benefit software company powering software for the free world. We eliminate the friction that slows innovation, enabling faster, more secure development and deployment of software across government and regulated networks. Built by national security veterans and backed by top-tier venture capital, our platform is trusted by the world’s leading organizations to cut deployment timelines from years to weeks. We move fast, solve hard problems, and deliver trusted capabilities where they’re needed most. Our work strengthens global security and gives the United States and its allies a lasting competitive advantage. Learn more at secondfront.com .

To apply, click the “Apply for This Job” button at the top or bottom of this page and complete the application form. This position will remain open until filled, and applications will be reviewed on a rolling basis.

In accordance with Colorado law, applicants may redact their date of birth, dates of attendance, and dates of graduation from any uploaded documents.

Under Maryland law, an employer may not require or demand, as a condition of employment, prospective employment, or continued employment, that an individual submit to or take a polygraph examination or similar test. An employer who violates this law is guilty of a misdemeanor and subject to a fine not exceeding $100.