Head of Security Compliance & Authorization

Second Front Systems•Washington, DC

2d•$200,000 - $215,000

About The Position

Second Front Systems (2F) is seeking a Head of Security Compliance & Authorization to lead the security programs that protect its Game Warden platform and enable its use across national security environments. Reporting to the Vice President of Security, this leader will own corporate compliance programs—including SOC 2, ISO, and CMMC—and security authorization for the Game Warden platform, including RMF and FedRAMP. The role leads the Security Authorization team, sets priorities and operating rhythms, and ensures the organization has the processes, technical capabilities, and evidence needed to deliver securely and maintain government authorizations. The role partners with Product, Engineering, Platform, Legal, and business leadership to integrate security throughout the product lifecycle. Areas include secure architecture, application security, vulnerability management, control implementation, authorization strategy, assessment readiness, and continuous monitoring. The successful candidate will build durable programs and high-performing teams, bring structure to complex security and compliance requirements, and balance mission delivery, customer commitments, technical risk, and regulatory expectations. Candidates must reside in the DC/Maryland/Virginia hiring hub. This is a full-time role. The base salary range is $200,000–$215,000, with potential eligibility for equity awards and discretionary bonuses. Applications are reviewed on a rolling basis, and the position remains open until filled.

Requirements

10 or more years of progressive cybersecurity experience, including significant responsibility for product security, cloud security, security engineering, compliance, or government authorization programs.
Five or more years leading cybersecurity professionals, with demonstrated success setting priorities, developing talent, managing performance, and scaling teams.
Experience owning security programs for a cloud platform, SaaS product, PaaS environment, or similarly complex technology organization.
Demonstrated success integrating security into product development and engineering workflows without creating unnecessary barriers to delivery.
Strong knowledge of application security, cloud security architecture, vulnerability management, secure software development, and software supply chain risk.
Practical understanding of AWS, Kubernetes, containers, CI/CD pipelines, infrastructure as code, identity and access management, logging, observability, and cloud-native security patterns.
Experience establishing or governing application security capabilities such as SAST, DAST, software composition analysis, secrets detection, container scanning, and penetration testing.
Direct experience with government security authorization programs, including NIST SP 800-53, NIST SP 800-37, DoD RMF, FedRAMP, or comparable federal requirements.
Experience overseeing the development, assessment, authorization, and continuous monitoring of complex authorization packages.
Familiarity with eMASS, DISA PPSM, DISA STIGs, SCAP Compliance Checker, ACAS, IAVM requirements, and the DISA Cloud Computing Security Requirements Guide.
Experience leading formal assessments and working with Security Control Assessors, third-party assessment organizations, government sponsors, and Authorizing Officials.
Ability to evaluate technical risk, understand competing priorities, and make sound decisions when requirements, timelines, or ownership are unclear.
Strong written and verbal communication skills, including the ability to explain technical and regulatory issues to engineers, customers, assessors, and executives.
Experience defining program metrics, presenting risk to senior leadership, and using data to guide staffing, investment, and remediation decisions.
Demonstrated ability to build repeatable processes and operating structures in a fast-moving environment.
CISSP or an equivalent advanced cybersecurity certification is required.
Must meet applicable DoD 8140 qualification requirements for the assigned work role.
Must reside in the DC/Maryland/Virginia hiring hub.

Nice To Haves

Active TS/SCI clearance or current eligibility.
Experience supporting DoD Impact Level 4 or Impact Level 5 cloud environments.
Experience leading FedRAMP Moderate or FedRAMP High authorization and continuous monitoring programs.
Experience with Kubernetes-based DevSecOps platforms or multi-tenant cloud environments supporting government customers.
Familiarity with CMMC, SOC 2, ISO 27001, ISO 20000-1, Cyber Essentials Plus, or international security assurance requirements.
Experience implementing automated control testing, compliance as code, or continuous evidence collection.
Experience developing a common control framework that supports multiple authorization and certification programs.
Experience managing third-party assessors, penetration testing providers, GRC platforms, and security technology vendors.
Advanced certifications such as CISM, CCSP, CSSLP, PMP, or CGRC.
Prior experience supporting national security, defense, intelligence, or other highly regulated customers.
Commitment to Second Front Systems’ mission of accelerating the secure delivery of mission-critical software to the U.S. government.

Responsibilities

Lead the Security Authorization and Compliance team.
Establish the Game Warden product security and compliance strategy in alignment with business objectives, the product roadmap, customer commitments, and enterprise security strategy.
Define ownership and operating processes for security authorization and continuous monitoring, including handoffs with Engineering and Security Operations.
Build a security roadmap covering capability gaps, required investments, staffing needs, technical dependencies, and measurable outcomes.
Provide leadership oversight for security authorization packages supporting Department of Defense, federal, and other national security environments.
Keep authorization packages, control implementations, assessment evidence, POA&Ms, and continuous monitoring activities accurate, current, and defensible.
Set standards and quality controls for Security Authorization Specialists managing eMASS packages, DISA PPSM registrations, assessment evidence, findings, and authorization documentation.
Direct readiness for security assessments, third-party reviews, government audits, and authorization decisions, ensuring issues are addressed before they block assessments.
Own the corporate audit calendar.
Partner with Engineering and Product leadership to integrate security requirements into product planning, architecture decisions, release processes, and engineering priorities.
Track vulnerability and configuration findings in relation to authorization and compliance impacts of significant changes.
Review significant product and infrastructure changes for effects on security controls, authorization boundaries, inherited services, customer commitments, and existing approvals.
Coordinate compliance across applicable frameworks, including DoD RMF, FedRAMP, CMMC, SOC 2, ISO standards, and other customer or market requirements.
Reduce duplicate work through reusable controls, shared evidence, common documentation, and cross-framework mappings.
Expand automation for control validation, evidence collection, continuous monitoring, compliance reporting, and authorization-package maintenance.
Establish metrics for product risk, vulnerabilities, remediation performance, assessment readiness, POA&M health, authorization milestones, and program capacity.
Report material risks, program status, resource constraints, and decisions requiring leadership attention to the Vice President of Security and executive leadership.
Manage relevant vendors, assessment partners, penetration testing providers, and GRC technology investments.
Coordinate with Security Operations and Incident Response when events affect authorizations or attestations.

Benefits

Competitive salary
100% employer-paid medical, dental, and vision coverage for the employee and dependents
401(k) with a 3% company contribution
Comprehensive wellness benefits, including a One Medical membership, mental health resources, and family planning support
Equity incentive plan
New-hire technology and home office stipend
Annual professional development stipend
Flexible paid time off and all federal holidays
Generous parental leave
Flexible remote work opportunities
Employee referral bonus program
Potential eligibility for discretionary bonuses