Platform Security & RMF Lead

This is a rare opportunity to define the security posture of a mission-critical DoD software platform from the ground up. 

As the Platform Security & RMF Lead, you will own the authorization posture and platform-level security discipline for DEFCON AI’s government-facing systems and integration platform. You are responsible for the full RMF lifecycle—from ATO strategy through continuous monitoring—and serve as the authoritative voice on whether the system is secure, compliant, and authorized to operate. 

You will work closely with Architecture and DevSecOps leadership to define the security standards the platform must meet, while ensuring cross-domain data flows comply with classification and authorization requirements. This is a deeply specialized role requiring expert-level fluency in DoD security frameworks, RMF processes, and cleared-system environments. 

This is a senior level role combining hands-on RMF execution with platform-wide security leadership. You will guide both government stakeholders and engineering teams through complex authorization, classification, and security decisions. 

Key Responsibilities 

ATO Strategy & RMF Ownership 

• Define and execute the ATO pathway, including responsibility allocation across government and contractor teams
• Author and maintain RMF documentation (SSP, SAP, SCTM, ConMon) in accordance with DoDI 8510.01 and NIST 800-53
• Coordinate with eMASS and Authorizing Officials on assessment and authorization activities
• Lead continuous monitoring and reauthorization efforts across the system lifecycle 

Cross-Domain Security & Classification Policy 

• Define security requirements for cross-domain data flows (IL-5, IL-6, tactical edge)
• Evaluate and guide selection of DoD-approved cross-domain solutions
• Ensure classification-aware data segmentation is enforceable, auditable, and aligned with policy (e.g., NOFORN, REL_TO, ORCON)
• Review system architecture to ensure compliant handling of classified data flows 

Multi-Enclave Security Architecture 

• Support secure operation across NIPR, SIPR, and higher classification environments
• Define authorization approaches (inheritance vs. standalone ATOs) across enclaves
• Ensure security posture scales without requiring fundamentally different architectures
• Maintain alignment with evolving joint and service-level security requirements 

Platform Security Advisory 

• Serve as the authoritative internal resource for DoD security and RMF-related questions
• Advise on container security, RBAC, service mesh security, PKI/CAC integration, and secrets management
• Define expectations for security scanning, container hardening, and vulnerability management (without owning the pipeline)
• Evaluate new capabilities for security and authorization impacts prior to production deployment 

Required Qualifications 

• 10+ years of information assurance or security engineering experience with increasing seniority
• 5+ years of hands-on ownership of RMF / ATO packages for DoD production systems, including at least one full authorization cycle (categorization → controls → implementation → assessment → authorization → ConMon).
• Deep familiarity with DoD security frameworks, RMF processes, and NIST 800-53 controls
• Proven ability to operate in complex, multi-enclave or classified environment
• US Citizenship Required
• Active Secret Clearance
• Willing to travel up to 25% for business needs 

Preferred Qualifications 

• Active TS/SCI Clearance
• Experience supporting USMC or Service-level network environments
• Experience with ATO inheritance, reciprocity, or common control provider model
• Experience with cross-domain solutions or multi-level security architectures \
• Familiarity with Palantir Foundry or Anduril Lattice environments
• Prior experience as an ISSO, SCA, or in a similar senior DoD security role 

What Success Looks Like 

• A clear ATO pathway is defined, approved by stakeholders, and actively progressing
• RMF artifacts and compliance evidence are built into the delivery process—not created after the fact
• Cross-domain data flows are secure by design, with classification policy embedded at the data level
• The platform operates securely across multiple enclaves without requiring re-architecture at each level
• Engineering teams proactively engage security early in design decisions
• Government stakeholders view the system’s security posture as credible, well-managed, and audit-ready