Head of Security Compliance – Authorization

This is a fully remote position, open to applicants in Maryland, +1 more state.

📋 Description

• Lead the Security Authorization and Compliance team.

• Develop the product security and compliance strategy for the Game Warden platform.

• Define responsibilities and operational processes for security authorization and ongoing monitoring.

• Create a security roadmap that addresses capability gaps, investments, staffing needs, dependencies, and measurable results.

• Provide leadership oversight for authorization packages that support Department of Defense, federal, and national security environments.

• Ensure the accuracy and defensibility of authorization packages, control implementations, evidence, POA&Ms, and continuous monitoring activities.

• Set standards and quality controls for eMASS packages, DISA PPSM registrations, assessment evidence, findings, and authorization documentation.

• Direct the readiness for security assessments, third-party reviews, government audits, and authorization decisions.

• Manage the corporate audit calendar.

• Integrate security requirements into product planning, architecture, releases, and engineering priorities.

• Monitor vulnerability and configuration findings in relation to authorization and compliance impact.

• Review significant product and infrastructure changes to assess their effects on controls, authorization boundaries, inherited services, customer commitments, and approvals.

• Coordinate compliance across DoD RMF, FedRAMP, CMMC, SOC 2, ISO standards, and other requirements.

• Establish reusable controls, shared evidence, common documentation, and cross-framework mappings.

• Enhance automation for control validation, evidence collection, continuous monitoring, reporting, and maintenance of authorization packages.

• Define metrics for product risk, vulnerabilities, remediation, assessment readiness, POA&M health, authorization milestones, and capacity.

• Report significant risks, program status, resource limitations, and decisions to the Vice President of Security and executive leadership.

• Manage vendors, assessment partners, penetration testing providers, and GRC technology investments.

• Collaborate with Security Operations and Incident Response when events impact authorizations or attestations.

• Work cross-functionally with Product, Engineering, Platform, Legal, and business leadership.

⛳️ Requirements

• 10+ years of progressive cybersecurity experience, including substantial responsibility for product security, cloud security, security engineering, compliance, or government authorization programs.

• Five or more years of experience in leading cybersecurity professionals.

• Experience managing security programs for a cloud platform, software-as-a-service product, platform-as-a-service environment, or similarly complex technology organization.

• Proven success in integrating security into product development and engineering workflows.

• Strong understanding of application security, cloud security architecture, vulnerability management, secure software development, and software supply chain risk.

• Practical knowledge of AWS, Kubernetes, containers, CI/CD pipelines, infrastructure as code, identity and access management, logging, observability, and cloud-native security patterns.

• Experience in establishing or overseeing SAST, DAST, software composition analysis, secrets detection, container scanning, and penetration testing.

• Direct experience with NIST SP 800-53, NIST SP 800-37, DoD RMF, FedRAMP, or comparable federal requirements.

• Experience in overseeing complex authorization packages and continuous monitoring.

• Familiarity with eMASS, DISA PPSM, DISA STIGs, SCAP Compliance Checker, ACAS, IAVM requirements, and DISA Cloud Computing Security Requirements Guide.

• Experience leading formal assessments with Security Control Assessors, third-party assessment organizations, government sponsors, and Authorizing Officials.

• Ability to assess technical risk and make informed decisions amid competing priorities.

• Strong written and verbal communication skills.

• Experience in defining program metrics and presenting risk to senior leadership.

• Capability to establish repeatable processes and operational structures.

• CISSP or an equivalent advanced cybersecurity certification is required.

• Must meet relevant DoD 8140 qualification requirements for the assigned work role.

• Active TS/SCI clearance or current eligibility is preferred.

• Experience supporting DoD Impact Level 4 or Impact Level 5 cloud environments is preferred.

• Experience leading FedRAMP Moderate or FedRAMP High programs is preferred.

• Experience with Kubernetes-based DevSecOps platforms or multi-tenant cloud environments is preferred.

• Familiarity with CMMC, SOC 2, ISO 27001, ISO 20000-1, Cyber Essentials Plus, or international security assurance requirements is preferred.

• Experience with automated control testing, compliance as code, or continuous evidence collection is preferred.

• Experience in developing common control frameworks is preferred.

• Experience managing third-party assessors, penetration testing providers, GRC platforms, and security technology vendors is preferred.

• Advanced certifications such as CISM, CCSP, CSSLP, PMP, or CGRC are preferred.

• Prior experience supporting national security, defense, intelligence, or highly regulated customers is preferred.

• Candidates must reside in the DC/Maryland/Virginia hiring hub.

🏝️ Benefits

• 100% employer-paid medical, dental, and vision coverage for you and your dependents.

• 401(k) plan with a 3% company contribution.

• Comprehensive wellness benefits, including a One Medical membership, mental health resources, family planning support, and more.

• Equity incentive plan.

• New hire technology and home office stipend.

• Annual professional development stipend.

• Flexible paid time off, plus all federal holidays.

• Generous parental leave.

• Flexible remote work opportunities.

• Employee referral bonus program.

• Potential eligibility for discretionary bonuses.