Head of Security Compliance & Authorization

Head of Security Compliance & Authorization

Second Front Systems (2F) is seeking a Head of Security Compliance & Authorization to lead the security programs that protect our Game Warden platform and enable its use across national security environments. Reporting to the Vice President of Security, this leader will own corporate compliance programs (SOC 2, ISO, CMMC, etc.) and security authorization for the Game Warden platform (RMF/FedRAMP).. You will lead the Security Authorization team, establish priorities and operating rhythms, and ensure the organization has the processes, technical capabilities, and evidence required to support secure product delivery and maintain government authorizations.

You will work closely with Product, Engineering, Platform, Legal, and business leadership to integrate security throughout the product lifecycle. This includes secure architecture, application security, vulnerability management, control implementation, authorization strategy, assessment readiness, and continuous monitoring.

This is a leadership role for someone who can build durable programs, develop high-performing teams, and bring structure to complex security and compliance requirements. The successful candidate will understand both cloud-native engineering and government authorization, with the judgment to balance mission delivery, customer commitments, technical risk, and regulatory expectations.

Note: Candidates must reside in our DC/Maryland/Virginia hiring hub

This is a full-time position.

 

What You'll Do

• Lead the Security Authorization and Compliance team.
• Establish the product security and compliance strategy for Game Warden in alignment with the company’s business objectives, product roadmap, customer commitments, and enterprise security strategy.
• Define ownership and operating processes for security authorization and continuous monitoring, including the handoffs with Engineering and Security Operations.
• Build a security roadmap that identifies capability gaps, required investments, staffing needs, technical dependencies, and measurable outcomes.
• Provide leadership oversight for security authorization packages supporting Department of Defense, federal, and other national security environments.
• Ensure authorization packages, control implementations, assessment evidence, POA&Ms, and continuous monitoring activities remain accurate, current, and defensible.
• Establish the standards and quality controls used by Security Authorization Specialists to manage eMASS packages, DISA PPSM registrations, assessment evidence, findings, and authorization documentation.
• Direct readiness activities for security assessments, third-party reviews, government audits, and authorization decisions. Ensure teams address issues before they become assessment blockers. • Own the corporate audit calendar. • Partner with Engineering and Product leadership to integrate security requirements into product planning, architecture decisions, release processes, and engineering priorities. • Track and report vulnerability/configuration findings against authorization and compliance impact of significant changes. • Review significant product and infrastructure changes to determine their effect on security controls, authorization boundaries, inherited services, customer commitments, and existing approvals. • Create a coordinated compliance approach across applicable frameworks, including DoD RMF, FedRAMP, CMMC, SOC 2, ISO standards, and other customer or market requirements. • Reduce duplicate work by establishing reusable controls, shared evidence, common documentation, and cross-framework mappings. • Expand the use of automation for control validation, evidence collection, continuous monitoring, compliance reporting, and authorization-package maintenance. • Establish meaningful metrics for product risk, vulnerabilities, remediation performance, assessment readiness, POA&M health, authorization milestones, and program capacity. • Provide the Vice President of Security and executive leadership with clear reporting on material risks, program status, resource constraints, and decisions requiring leadership attention. • Manage relevant vendors, assessment partners, penetration testing providers, and GRC technology investments. • Coordinate with Security Operations and Incident Response teams when events affect authorizations or attestations.