Platform Security & RMF Lead, DEFCON AI

• This is a deeply specialized role requiring expert-level fluency in DoD security frameworks, RMF processes, and cleared-system environments
• 10+ years of information assurance or security engineering experience with increasing seniority
• 5+ years of hands-on ownership of RMF / ATO packages for DoD production systems, including at least one full authorization cycle (categorization → controls → implementation → assessment → authorization → ConMon)
• Deep familiarity with DoD security frameworks, RMF processes, and NIST 800-53 controls
• Proven ability to operate in complex, multi-enclave or classified environment
• US Citizenship Required
• Active Secret Clearance
• Willing to travel up to 25% for business needs

Desirable

• This is a rare opportunity to define the security posture of a mission-critical DoD software platform from the ground up
• As the Platform Security & RMF Lead, you will own the authorization posture and platform-level security discipline for DEFCON AI’s government-facing systems and integration platform
• You are responsible for the full RMF lifecycle—from ATO strategy through continuous monitoring—and serve as the authoritative voice on whether the system is secure, compliant, and authorized to operate
• You will work closely with Architecture and DevSecOps leadership to define the security standards the platform must meet, while ensuring cross-domain data flows comply with classification and authorization requirements
• This is a senior level role combining hands-on RMF execution with platform-wide security leadership. You will guide both government stakeholders and engineering teams through complex authorization, classification, and security decisions
• ATO Strategy & RMF Ownership:
• Define and execute the ATO pathway, including responsibility allocation across government and contractor teams
• Author and maintain RMF documentation (SSP, SAP, SCTM, ConMon) in accordance with DoDI 8510.01 and NIST 800-53
• Coordinate with eMASS and Authorizing Officials on assessment and authorization activities
• Lead continuous monitoring and reauthorization efforts across the system lifecycle
• Cross-Domain Security & Classification Policy:
• Define security requirements for cross-domain data flows (IL-5, IL-6, tactical edge)
• Evaluate and guide selection of DoD-approved cross-domain solutions
• Ensure classification-aware data segmentation is enforceable, auditable, and aligned with policy (e.g., NOFORN, REL_TO, ORCON)
• Review system architecture to ensure compliant handling of classified data flows
• Multi-Enclave Security Architecture:
• Support secure operation across NIPR, SIPR, and higher classification environments
• Define authorization approaches (inheritance vs. standalone ATOs) across enclaves
• Ensure security posture scales without requiring fundamentally different architectures
• Maintain alignment with evolving joint and service-level security requirements
• Platform Security Advisory:
• Serve as the authoritative internal resource for DoD security and RMF-related questions
• Advise on container security, RBAC, service mesh security, PKI/CAC integration, and secrets management
• Define expectations for security scanning, container hardening, and vulnerability management (without owning the pipeline)
• Evaluate new capabilities for security and authorization impacts prior to production deployment
• What Success Looks Like:
• A clear ATO pathway is defined, approved by stakeholders, and actively progressing
• RMF artifacts and compliance evidence are built into the delivery process—not created after the fact
• Cross-domain data flows are secure by design, with classification policy embedded at the data level
• The platform operates securely across multiple enclaves without requiring re-architecture at each level
• Engineering teams proactively engage security early in design decisions
• Government stakeholders view the system’s security posture as credible, well-managed, and audit-ready