Senior Manager, Cybersecurity (R6149)

Own the authorization portfolio

• Hold overall accountability for RMF execution across all Shield AI classified systems under JSIG, DAAPM, and NIST SP 800-53, driving toward continuous authorization as the goal state.
• Maintain a single authoritative view of authorization posture: ATO and IATT status, expiration dates, conditions, open POA&M items, and assessment findings across every system and site.
• Own the accreditation roadmap and commit dates with program management, and manage the dependencies — facility, network, tooling, and personnel — that determine whether those dates hold.
• Represent Shield AI as the senior security authority with Authorizing Officials, SCAs, government program security officers, and DCSA or cognizant SAPCO representatives.
• Drive reciprocity and inheritance strategy so controls implemented once are reused across programs and sites instead of re-litigated in each package.
• Approve risk acceptance recommendations, deviations, and mitigation strategies before they go to the government, and escalate residual risk to Shield AI leadership with a clear position.

Build the capability, not just the packages

• Define the enterprise continuous monitoring strategy — vulnerability scanning, STIG and SRG compliance, audit review, and configuration drift detection — and hold the team to a reportable cadence.
• Standardize package templates, control evidence libraries, hardening baselines, and inheritance documentation so new enclaves start from an accredited pattern.
• Invest in automation — infrastructure as code, scripted STIG application, scan and evidence pipelines — to make compliance repeatable rather than heroic.
• Select and own the security compliance toolchain (eMASS or Xacta, ACAS/Nessus, SCAP, SIEM) including budget, licensing, and government-directed tooling requirements.
• Define metrics that reflect real security posture and report them to Federal Systems and company leadership.

Partner across the company

• Work with IT, network, platform, and product security engineers so security architecture is designed in rather than retrofitted before an assessment.
• Partner with Industrial Security, Facilities, and Contracts on new facility and enclave stand-ups from concept through ATO, including accredited network extensions between facilities.
• Advise program managers and engineering leadership on accreditation timelines and the security consequences of architecture, schedule, and staffing decisions.
• Own incident response leadership on classified systems: containment, spillage and contamination response, government reporting, and after-action corrective plans.
• Ensure the classified user population is trained, access is least-privilege and auditable, and data transfer and media control actions follow program guidance.