Head of Security Compliance – Authorization

Second Front Systems

. Lead the Security Authorization and Compliance team .

Posted 10/16/2026full-timeRemote • United StatesLead💰 $200,000 - $215,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in cybersecurity leadership, particularly in product security and compliance for cloud platforms. Proficient in integrating security into product development, managing complex authorization packages, and establishing metrics for risk and compliance.

Highest-signal resume keywords

10+ Years Cybersecurity ExperienceCISSP CertificationExperience Leading Cybersecurity ProfessionalsKnowledge of NIST SP 800-53Experience with AWS and Kubernetes

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Product SecurityCloud Security ArchitectureVulnerability ManagementSecure Software DevelopmentContinuous MonitoringAutomated Control TestingCompliance as CodePenetration TestingRisk EvaluationProgram Metrics Definition

Soft Skills

Strong Written CommunicationStrong Verbal CommunicationDecision-MakingProcess BuildingLeadership Oversight

Tools & Technologies

EMASSDISA PPSMSCAP Compliance CheckerACASCI/CD PipelinesIdentity and Access ManagementCloud-Native Security PatternsGRC PlatformsSecurity Technology VendorsKubernetes-Based DevSecOps

Certifications & Qualifications

CISSPCISMCCSPCSSLPPMPCGRC

Industry Keywords

DoD RMFFedRAMPCMMCSOC 2ISO 27001ISO 20000-1Cyber Essentials PlusNational SecurityDefenseIntelligence

Tech Stack

Tools & technologies

AWSCloudCyber SecurityKubernetesPMPTypeScript

About the role

Key responsibilities & impact

Lead the Security Authorization and Compliance team
Establish the product security and compliance strategy for the Game Warden platform
Define ownership and operating processes for security authorization and continuous monitoring
Build a security roadmap covering capability gaps, investments, staffing, dependencies, and measurable outcomes
Provide leadership oversight for authorization packages supporting Department of Defense, federal, and national security environments
Maintain accurate and defensible authorization packages, control implementations, evidence, POA&Ms, and continuous monitoring activities
Establish standards and quality controls for eMASS packages, DISA PPSM registrations, assessment evidence, findings, and authorization documentation
Direct readiness for security assessments, third-party reviews, government audits, and authorization decisions
Own the corporate audit calendar
Integrate security requirements into product planning, architecture, releases, and engineering priorities
Track vulnerability and configuration findings against authorization and compliance impact
Review significant product and infrastructure changes for effects on controls, authorization boundaries, inherited services, customer commitments, and approvals
Coordinate compliance across DoD RMF, FedRAMP, CMMC, SOC 2, ISO standards, and other requirements
Establish reusable controls, shared evidence, common documentation, and cross-framework mappings
Expand automation for control validation, evidence collection, continuous monitoring, reporting, and authorization-package maintenance
Establish metrics for product risk, vulnerabilities, remediation, assessment readiness, POA&M health, authorization milestones, and capacity
Report material risks, program status, resource constraints, and decisions to the Vice President of Security and executive leadership
Manage vendors, assessment partners, penetration testing providers, and GRC technology investments
Coordinate with Security Operations and Incident Response when events affect authorizations or attestations
Work cross-functionally with Product, Engineering, Platform, Legal, and business leadership

Requirements

What you’ll need

10+ years of progressive cybersecurity experience, including significant responsibility for product security, cloud security, security engineering, compliance, or government authorization programs
Five or more years of experience leading cybersecurity professionals
Experience owning security programs for a cloud platform, software-as-a-service product, platform-as-a-service environment, or similarly complex technology organization
Demonstrated success integrating security into product development and engineering workflows
Strong knowledge of application security, cloud security architecture, vulnerability management, secure software development, and software supply chain risk
Practical understanding of AWS, Kubernetes, containers, CI/CD pipelines, infrastructure as code, identity and access management, logging, observability, and cloud-native security patterns
Experience establishing or governing SAST, DAST, software composition analysis, secrets detection, container scanning, and penetration testing
Direct experience with NIST SP 800-53, NIST SP 800-37, DoD RMF, FedRAMP, or comparable federal requirements
Experience overseeing complex authorization packages and continuous monitoring
Familiarity with eMASS, DISA PPSM, DISA STIGs, SCAP Compliance Checker, ACAS, IAVM requirements, and DISA Cloud Computing Security Requirements Guide
Experience leading formal assessments with Security Control Assessors, third-party assessment organizations, government sponsors, and Authorizing Officials
Ability to evaluate technical risk and make sound decisions amid competing priorities
Strong written and verbal communication skills
Experience defining program metrics and presenting risk to senior leadership
Ability to build repeatable processes and operating structures
CISSP or equivalent advanced cybersecurity certification required
Must meet applicable DoD 8140 qualification requirements for the assigned work role
Active TS/SCI clearance or current eligibility preferred
Experience supporting DoD Impact Level 4 or Impact Level 5 cloud environments preferred
Experience leading FedRAMP Moderate or FedRAMP High programs preferred
Experience with Kubernetes-based DevSecOps platforms or multi-tenant cloud environments preferred
Familiarity with CMMC, SOC 2, ISO 27001, ISO 20000-1, Cyber Essentials Plus, or international security assurance requirements preferred
Experience with automated control testing, compliance as code, or continuous evidence collection preferred
Experience developing common control frameworks preferred
Experience managing third-party assessors, penetration testing providers, GRC platforms, and security technology vendors preferred
Advanced certifications such as CISM, CCSP, CSSLP, PMP, or CGRC preferred
Prior experience supporting national security, defense, intelligence, or highly regulated customers preferred
Candidates must reside in the DC/Maryland/Virginia hiring hub

Benefits

Comp & perks

100% employer-paid medical, dental, and vision coverage for you and your dependents
401(k) with a 3% company contribution
Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more
Equity incentive plan
New hire technology and home office stipend
Annual professional development stipend
Flexible paid time off, plus all federal holidays
Generous parental leave
Flexible remote work opportunities
Employee referral bonus program
Potential eligibility for discretionary bonuses