Security Authorization Lead

Security Authorization Lead

Washington, DC or New York, NY
• Full-time
• Hybrid (3+ days/week in office)

Gov Signals is the AI system of work for government contracting. It can take the government longer to buy a capability than an adversary takes to field one, and we exist to close that gap.

We're the only startup managing government contract data with AI in both FedRAMP High and DoW Impact Level 5 environments. Our platform monitors 5,000+ live government data sources, 100,000+ federal and state agencies, and 2,000,000+ government contracts in real time. Our customers in government include offices like DIU and SOCOM, and our customers in industry range from small contractors to Fortune 500 primes with billions in annual awards.

In the past 18 months, we've earned FedRAMP High and IL5 authorizations, joined GSA MAS and the MDA SHIELD IDIQ, and signed some of the biggest names in government contracting.

We're hiring a Security Authorization Lead to get Gov Signals deployments through government security approval and keep them approved. You'll work under the CISO with support from the CTO, and you'll be the first person here dedicated to this work full time.

Our customers cannot use Gov Signals until their own security office says yes. Every deployment brings a different boundary, a different set of reviewers, and a different list of questions about how their data is handled. You'll plan that path with the customer before work starts, write documentation that survives a line-by-line read, answer reviewers directly, carry findings to closure, and keep the evidence current after so the next deployment starts ahead of where the last one did.

Gov Signals operates at FedRAMP High and DoW IL5 today. Some deployments will require IL6. The work also covers CMMC Level 2, SOC 2, and whatever a specific customer asks for.

• Plan the authorization path for each customer deployment: scope the boundary, work out which controls we inherit and which we answer for, and agree the steps with the customer's security office before work starts.

• Write and maintain what approval depends on: system security plans, control narratives, architecture diagrams, and the supporting artifacts reviewers ask for.

• Prepare for assessments and reviews, answer reviewer questions directly, and track findings and POA&M items until they close.

• Keep approvals in force once granted: continuous monitoring reporting, significant change requests, annual assessments, and the vulnerability and patch evidence behind them.

• Own customer security questionnaires and security reviews, and keep a response library so each one starts from the last.

• Work with engineering when a requirement has a technical consequence: say what the control means in the product, then follow it to done.

We deploy through Defense Unicorns, Second Front Game Warden, and Palantir Fed Start.

• You've personally taken a system through a federal or DoW authorization and stayed with it through its ongoing obligations. What you did matters more than what your title was.

• Direct experience with government security reviewers, assessors, or an authorizing official's staff. You've been the one answering the questions.

• Working knowledge of NIST 800-53, RMF, and the DoW Cloud Computing SRG, including how control inheritance works when you run on an authorized platform.

• Writing that holds up under close reading. A vague answer in a package or a questionnaire can hold a deployment for weeks.

• Enough cloud fluency to read an architecture diagram, a Kubernetes manifest, or a CI configuration and ask the right question. You don't have to implement the control yourself.

Nice to have: CMMC Level 2 or SOC 2 experience; time inside a government…