Security Authorization Lead

Washington, DC or New York, NY • Full-time • Hybrid (3+ days/week in office)

GovSignals is the AI system of work for government contracting. It can take the government longer to buy a capability than an adversary takes to field one, and we exist to close that gap.

We're the only startup managing government contract data with AI in both FedRAMP High and DoW Impact Level 5 environments. Our platform monitors 5,000+ live government data sources, 100,000+ federal and state agencies, and 2,000,000+ government contracts in real time. Our customers in government include offices like DIU and SOCOM, and our customers in industry range from small contractors to Fortune 500 primes with billions in annual awards. In the past 18 months, we've earned FedRAMP High and IL5 authorizations, joined GSA MAS and the MDA SHIELD IDIQ, and signed some of the biggest names in government contracting.

We're hiring a Security Authorization Lead to get GovSignals deployments through government security approval and keep them approved. You'll work under the CISO with support from the CTO, and you'll be the first person here dedicated to this work full time.

Our customers cannot use GovSignals until their own security office says yes. Every deployment brings a different boundary, a different set of reviewers, and a different list of questions about how their data is handled. You'll plan that path with the customer before work starts, write documentation that survives a line-by-line read, answer reviewers directly, carry findings to closure, and keep the evidence current afterward so the next deployment starts ahead of where the last one did.

GovSignals operates at FedRAMP High and DoW IL5 today. Some deployments will require IL6. The work also covers CMMC Level 2, SOC 2, and whatever a specific customer asks for.

• Plan the authorization path for each customer deployment: scope the boundary, work out which controls we inherit and which we answer for, and agree the steps with the customer's security office before work starts.

• Write and maintain what approval depends on: system security plans, control narratives, architecture diagrams, and the supporting artifacts reviewers ask for.

• Prepare for assessments and reviews, answer reviewer questions directly, and track findings and POA&M items until they close.

• Keep approvals in force once granted: continuous monitoring reporting, significant change requests, annual assessments, and the vulnerability and patch evidence behind them.

• Own customer security questionnaires and security reviews, and keep a response library so each one starts from the last.

• Work with engineering when a requirement has a technical consequence: say what the control means in the product, then follow it to done.

We deploy through Defense Unicorns, SecondFront GameWarden, and Palantir FedStart.

• You've personally taken a system through a federal or DoW authorization and stayed with it through its ongoing obligations. What you did matters more than what your title was.

• Direct experience with government security reviewers, assessors, or an authorizing official's staff. You've been the one answering the questions.

• Working knowledge of NIST 800-53, RMF, and the DoW Cloud Computing SRG, including how control inheritance works when you run on an authorized platform.

• Writing that holds up under close reading. A vague answer in a package or a questionnaire can hold a deployment for weeks.

• Enough cloud fluency to read an architecture diagram, a Kubernetes manifest, or a CI configuration and ask the right question. You don't have to implement the control yourself.

Nice to have: CMMC Level 2 or SOC 2 experience; time inside a government program office, a 3PAO, or an assessment organization; a deployment you had to get approved more than once, in more than one place; familiarity with AWS GovCloud and Kubernetes.

Clearance: not required. An active or previous clearance is a plus.

GovSignals was founded by four cofounders who lived with this problem from both sides (selling to the government and serving inside it) with backgrounds across the Defense Intelligence Agency, the Department of Energy, Palantir, Amazon, federal contractors building for missiles, and state contractors building for prisons. You'll work directly with all four. Other team members at GovSignals have shipped to defense companies, scaled venture-backed startups, and founded companies of their own.

Design by HI (Human Intelligence), Work by AI (Artificial Intelligence). Human Intelligence takes responsibility for what we build and how we communicate to customers. Artificial Intelligence does much of the building. We provide unlimited Claude and ChatGPT credits for reasonable use, and we expect you to come in with extensive AI experience.

• Intro conversation (30 min): your background and how you work.

• Working session (1 hr): real-world inspired security exercises.

• Co-founder conversations (15 min): meet the cofounders.

• Meet the team in person (45 min): time with the team at our Washington, DC or Brooklyn, NY office.

• Offer.

• Base Salary: $140,000 – $190,000

• Equity: Meaningful stake in a well-funded, fast-growing startup

• Benefits: medical, vision, and dental, unlimited PTO

• Hybrid in our Washington, DC or Brooklyn Navy Yard offices, 3+ days a week in person. The Yard built ships for the Navy from 1801 to 1966, now we build systems for Navy program offices.

Due to the nature of our government work, this role is open only to U.S. citizens and other U.S. Persons. GovSignals is an equal opportunity employer