SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 200,000 - 215,000 / annual
Second Front Systems is seeking a Head of Security Compliance & Authorization to lead security programs protecting the Game Warden platform for national security environments. Reporting to the Vice President of Security, you will own corporate compliance programs (SOC 2, ISO, CMMC) and security authorization for the platform (RMF/FedRAMP). You will lead the Security Authorization team, establish priorities and operating rhythms, and ensure the organization has processes, technical capabilities, and evidence required for secure product delivery and government authorizations.
Key responsibilities include: leading the Security Authorization and Compliance team; establishing product security and compliance strategy aligned with business objectives and customer commitments; defining ownership and operating processes for security authorization and continuous monitoring; building a security roadmap identifying capability gaps, staffing needs, and measurable outcomes; providing leadership oversight for authorization packages supporting Department of Defense and federal environments; ensuring authorization packages, control implementations, and assessment evidence remain accurate and defensible; establishing standards and quality controls for Security Authorization Specialists managing eMASS packages and authorization documentation; directing readiness activities for security assessments, third-party reviews, and government audits; owning the corporate audit calendar; partnering with Engineering and Product leadership to integrate security into product planning and release processes; tracking vulnerability and configuration findings against authorization impact; reviewing significant product and infrastructure changes for security control effects; creating coordinated compliance approaches across DoD RMF, FedRAMP, CMMC, SOC 2, and ISO frameworks; reducing duplicate work through reusable controls and cross-framework mappings; expanding automation for control validation and evidence collection; establishing meaningful metrics for product risk and program capacity; providing executive leadership with clear reporting on material risks and resource constraints; and managing vendors, assessment partners, and GRC technology investments.
You will work closely with Product, Engineering, Platform, Legal, and business leadership to integrate security throughout the product lifecycle, including secure architecture, application security, vulnerability management, and continuous monitoring.
REQUIREMENTS:
- 10+ years of progressive cybersecurity experience, including significant responsibility for product security, cloud security, security engineering, compliance, or government authorization programs
- 5+ years of experience leading cybersecurity professionals, with demonstrated success setting priorities, developing talent, managing performance, and scaling teams
- Experience owning security programs for a cloud platform, SaaS product, PaaS environment, or similarly complex technology organization
- Demonstrated success integrating security into product development and engineering workflows
- Strong knowledge of application security, cloud security architecture, vulnerability management, secure software development, and software supply chain risk
- Practical understanding of AWS, Kubernetes, containers, CI/CD pipelines, infrastructure as code, identity and access management, logging, observability, and cloud-native security patterns
- Experience establishing or governing application security capabilities (SAST, DAST, software composition analysis, secrets detection, container scanning, penetration testing)
- Direct experience with government security authorization programs including NIST SP 800-53, NIST SP 800-37, DoD RMF, FedRAMP, or comparable federal requirements
- Experience overseeing development, assessment, authorization, and continuous monitoring of complex authorization packages
- Familiarity with eMASS, DISA PPSM, DISA STIGs, SCAP Compliance Checker, ACAS, IAVM requirements, and DISA Cloud Computing Security Requirements Guide
- Experience leading formal assessments and working with Security Control Assessors, third-party assessment organizations, government sponsors, and Authorizing Officials
- Ability to evaluate technical risk, understand competing priorities, and make sound decisions when requirements or ownership are unclear
- Strong written and verbal communication skills for explaining technical and regulatory issues to engineers, customers, assessors, and executives
- Experience defining program metrics, presenting risk to senior leadership, and using data to guide staffing and investment decisions
- Demonstrated ability to build repeatable processes and operating structures in fast-moving environments
- CISSP or equivalent advanced cybersecurity certification required
- Must meet applicable DoD 8140 qualification requirements for the assigned work role
PREFERRED:
- Active TS/SCI clearance or current eligibility
- Experience supporting DoD Impact Level 4 or Impact Level 5 cloud environments
- Experience leading FedRAMP Moderate or FedRAMP High authorization and continuous monitoring programs
- Experience with Kubernetes-based DevSecOps platforms or multi-tenant cloud environments supporting government customers
- Familiarity with CMMC, SOC 2, ISO 27001, ISO 20000-1, Cyber Essentials Plus, or international security assurance requirements
- Experience implementing automated control testing, compliance as code, or continuous evidence collection
- Experience developing common control frameworks supporting multiple authorization programs
- Experience managing third-party assessors, penetration testing providers, GRC platforms, and security technology vendors
- Advanced certifications such as CISM, CCSP, CSSLP, PMP, or CGRC
- Prior experience supporting national security, defense, intelligence, or highly regulated customers
