← All roles

Head of Security Compliance & Authorization

Second Front Systems· Security
Apply on company site
Remote$200k - $215k + equity + bonusFull-timePosted 5d ago

About the role

Lead security programs for Game Warden, owning corporate compliance (SOC 2, ISO, CMMC) and government security authorization (RMF/FedRAMP) while building durable teams and coordinating with Product, Engineering, Legal, and leadership to integrate security throughout the product lifecycle.

Responsibilities

  • Lead the Security Authorization and Compliance team.
  • Establish the product security and compliance strategy for Game Warden in alignment with business objectives, product roadmap, customer commitments, and enterprise security strategy.
  • Define ownership and operating processes for security authorization and continuous monitoring, including handoffs with Engineering and Security Operations.
  • Build a security roadmap identifying capability gaps, investments, staffing, dependencies, and measurable outcomes.
  • Provide leadership oversight for security authorization packages supporting DoD, federal, and other national security environments.
  • Ensure authorization packages, control implementations, assessment evidence, POA&Ms, and continuous monitoring activities remain accurate and defensible.
  • Establish standards and quality controls for managing eMASS, DISA PPSM, assessment evidence, findings, and documentation.
  • Direct readiness activities for security assessments, third-party reviews, government audits, and authorization decisions; address issues before they become blockers.
  • Own the corporate audit calendar.
  • Partner with Engineering and Product to integrate security requirements into planning, architecture, release processes, and priorities.
  • Track and report vulnerability/configuration findings against authorization/compliance impact of significant changes.
  • Review significant product/infrastructure changes for effects on security controls and approvals.
  • Create a coordinated compliance approach across DoD RMF, FedRAMP, CMMC, SOC 2, ISO, and other frameworks; reduce duplicate work.
  • Expand automation for control validation, evidence collection, continuous monitoring, reporting, and maintenance of authorization packages.
  • Establish metrics for product risk, vulnerabilities, remediation, readiness, POA&M health, milestones, and program capacity.
  • Provide leadership with clear risk and program status reporting; highlight material risks and decisions.
  • Manage vendors, assessment partners, pen testers, and GRC technology investments.
  • Coordinate with Security Operations and Incident Response when events affect authorizations or attestations.

Qualifications

  • Have 10+ years of progressive cybersecurity experience with responsibility for product security, cloud security, security engineering, compliance, or government authorization programs.
  • Five+ years of experience leading cybersecurity professionals and scaling teams.
  • Experience owning security programs for cloud platforms, SaaS/PaaS environments, or similarly complex tech orgs.
  • Proven ability to integrate security into product development without hindering delivery.
  • Strong knowledge of application security, cloud security architecture, vulnerability management, secure software development, and software supply chain risk.
  • Practical understanding of AWS, Kubernetes, containers, CI/CD, IaC, IAM, logging/observability, and cloud-native security patterns.
  • Experience establishing/gov application security capabilities (SAST, DAST, SCA, secrets detection, container scanning, pentesting).
  • Direct experience with government security authorization programs (NIST SP 800-53/800-37, DoD RMF, FedRAMP).
  • Experience overseeing development, assessment, authorization, and continuous monitoring of complex packages.
  • Familiarity with eMASS, DISA PPSM, DISA STIGs, SCAP, ACAS, IAVM, DISA Cloud Security requirements.
  • Experience leading formal assessments with assessors, third-party orgs, sponsors, and Authorizing Officials.
  • Ability to evaluate technical risk and balance priorities, timelines, and ownership.
  • Strong written and verbal communication for engineers, customers, assessors, and executives.
  • Experience defining program metrics and using data to guide staffing, investment, and remediation decisions.
  • Demonstrated ability to build repeatable processes and operating structures in a fast-moving environment.
  • CISSP or equivalent certification required.
  • Must meet DoD 8140 qualification requirements for the assigned work role.

Skills

Required:Security LeadershipGovernment Security Authorization

Benefits

  • Competitive salary
  • 100% employer-paid medical, dental, and vision coverage for you and dependents
  • 401(k) with 3% company contribution
  • Wellness benefits including One Medical membership and mental health resources
  • Equity incentive plan
  • New hire technology and home office stipend
  • Annual professional development stipend
  • Flexible paid time off plus federal holidays
  • Generous parental leave
  • Flexible remote work opportunities
  • Employee referral bonus program
Last updated Oct 21, 2026. Interested? Apply on the company site.
Second Front Systems logo

About Second Front Systems

Powering software for the free world.

Discover a better path to ATO. Leverage Second Front’s accredited software platform to fast-track securing authorization for government use of your SaaS software.

softwaregovernmentsecurityaccreditationSaaScompliancecloud
Company profileWebsite

More open roles at Second Front Systems