Responsibilities
- Define and implement a comprehensive information security strategy that safeguards critical assets, including classified data, intellectual property, customer systems, and core infrastructure.
- Act as the top executive authority for cyber risk decisions, providing final oversight on security posture with enterprise-wide implications and advising the CEO and leadership team on threat landscapes and business impacts.
- Collaborate with executive leadership, legal, and business development to align security initiatives with contractual obligations, growth goals, and mission priorities.
- Serve as the primary representative of security posture in engagements with customers, government entities, partners, and during contract negotiations.
- Provide executive leadership to the Directors of Security Compliance and Information Technology, ensuring alignment between compliance, IT operations, and security programs.
- Promote a unified, mission-driven security culture that supports agility while reducing organizational and customer risk.
- Lead the development and execution of a responsible AI integration strategy across all business functions, ensuring security integrity and verifiable controls.
- Modernize application security practices to address AI-driven threat landscapes, including scalable bug triage and bounty programs consistent with open-source principles and responsible disclosure trends.
- Develop and expand defensive security technologies that empower teams to proactively defend against emerging threats such as supply chain compromises, advanced persistent threats, and foreign adversary tactics.
- Lead cross-functional initiatives to protect cloud platforms, production systems, and mission-critical infrastructure from sophisticated cyber threats while meeting regulatory and strategic objectives.
- Build and manage a high-performance security engineering team focused on securing production and customer-facing environments through architecture design, system hardening, and threat detection.
- Set the strategic direction for scalable security architecture and infrastructure protection, guiding technical vision while delegating implementation to the Director of IT.
- Advance automation across security workflows to accelerate threat detection and response, improving operational efficiency and resilience.
- Sponsor the Incident Response program, ensuring readiness, cross-functional training, and compliance with DFARS 252.204-7012 notification requirements.
- Own the enterprise Governance, Risk, and Compliance (GRC) framework, establishing policies, risk tolerance levels, and accountability mechanisms across departments.
- Sponsor and maintain compliance with CMMC Level 2 standards, including adherence to DFARS clauses 252.204-7012 and 7021, POA&M governance, and audit preparedness across all contracts.
- Oversee third-party and supply chain risk management in accordance with NIST SP 800-161, with final approval authority on technology investments affecting compliance.
- Serve as the senior liaison to government regulators, C3PAO assessors, and external auditors.
- Deliver regular reports on cyber risk, program effectiveness, and compliance status to executive leadership.
- Cultivate an organization-wide security mindset that views security as an enabler of mission success rather than a constraint.
- Lead enterprise-wide security awareness and training initiatives to ensure all employees and contractors understand their role in maintaining security standards.
- Translate complex technical security concepts into clear, actionable insights for audiences ranging from technical staff to executives, board members, and government officials.
- Drive risk-aware decision-making across all levels of the organization by establishing clear, well-understood security boundaries and accountability.
Other
- An active DoD TS/SCI security clearance is mandatory.
- Must be capable of representing the organization to government stakeholders and in customer-facing roles.
- Executive presence and the ability to advise internal and external leadership are critical.
- Dual oversight of security and IT functions is a required and intentional aspect of the role.
- Security culture must be deeply integrated into operations, aligned with 'The Unicorn Experience', not added as an afterthought.
- Responsible for ensuring the IT foundation is modern, resilient, and capable of supporting rapidly scaling defense technology operations.
