Security Engineering Accredidation Lead, Defense

Applied Intuition•Arlington, VA

21h•$175,000 - $225,000•Onsite

About The Position

Applied Intuition is seeking an Accreditation Lead to own the authorization portfolio for government and defense programs. This is a decision-making role responsible for determining how programs get authorized, presenting plans to government sponsors and authorizing officials, and ensuring engineering teams meet requirements to achieve and maintain authorization. The portfolio includes cloud environments subject to FedRAMP and DoD Impact Level requirements, authorizations for deployed systems, encrypted communications, and CMMC. The role requires a security clearance and close collaboration with the ISSM for classified systems, platform and DevSecOps engineers, and program leadership. The company expects full-time employees to work primarily from an Applied Intuition office five days per week, while allowing occasional remote work and schedule flexibility. This in-office expectation does not apply to contractor positions.

Requirements

Bachelor's degree in Cyber Security, Information Systems, Computer Science, or a related field, or equivalent hands-on experience.
At least 8 years of experience in system authorization or security compliance, including at least 3 years leading authorizations across multiple programs at once.
Led at least one FedRAMP or DoD IL4 or IL5 authorization from initiation through authorization.
Experience authorizing deployed or tactical systems under RMF and working directly with program authorizing officials.
Track record of owning authorization decisions and defending them with authorizing officials, sponsors, and program offices.
Experience driving engineering teams to adopt security requirements, including making and defending trade-off decisions.
Deep working knowledge of RMF (NIST SP 800-37), NIST SP 800-53 Rev 5 baselines, the DoD Cloud Computing Security Requirements Guide, and eMASS.
Working knowledge of NSA Commercial Solutions for Classified or other approved encryption architectures.
Working knowledge of NIST SP 800-171 and CMMC Level 2 obligations.
Experience managing third-party assessors and support contractors.
DoD 8140 qualification for an ISSM role, such as CISSP or CISM, or ability to obtain it within six months of hire.
Must be a U.S. citizen.
Must hold or be eligible to obtain and maintain a U.S. security clearance.
Judgment to know when to push, compromise, or escalate with government customers and engineers.

Nice To Haves

Experience authorizing classified cloud environments.
Experience as an ISSM on maritime, uncrewed, or autonomy programs.
Participation in the FedRAMP 20x pilot or similar automation-first authorization efforts.
Experience building an authorization program where none existed before.
Familiarity with continuous ATO approaches and DoD risk management modernization efforts.
Certifications such as CISSP, CISM, CGRC, or CCSP.
An active Top Secret clearance.

Responsibilities

Own the authorization portfolio across government programs, determining which authorizations are needed, their sequence, and whether programs authorize directly or inherit from an existing authorization.
Make and own authorization decisions, including approach, scope, sequencing, and risk recommendations to leadership.
Present authorization plans to government sponsors and authorizing officials, negotiate scope and timelines, and drive agreement.
Serve as ISSM of record for cloud and program authorizations under RMF, owning system security plans, POA&Ms, and authorization packages.
Maintain software approvals and authorizations on partner and customer platforms, including renewals and new releases.
Set security requirements for engineering teams early, hold teams to those requirements through design and delivery, and make trade-off decisions when needed.
Coordinate authorizations for deployed systems and their connections, including encrypted links and interconnection agreements with customer and partner systems.
Partner with the ISSM for classified systems to keep cloud, program, and classified authorizations consistent.
Serve as the primary interface for CMMC Level 2 assessments, including assessor coordination, POA&M adjudication, and support for annual affirmation.
Manage third-party assessors and support contractors from kickoff through authorization.
Own continuous monitoring after authorization, using machine-readable evidence produced by the delivery pipeline wherever possible.
Maintain the authorization calendar across programs, including renewals, assessments, and dependencies, and brief leadership and customers on status and risk.
Serve as a documented backup for authorization activity and participate in the security on-call rotation as it is established.