Come work at a place where innovation and teamwork come together to support the most exciting missions in the world!
Role Overview Qualys is seeking a highly strategic and technically proficient Senior Director, Government Product Security Management. Reporting directly to the VP, Head of Product Security, this leader will take ownership of Qualys’ critical federal compliance programs. This role is responsible for the end-to-end oversight, strategic direction, and operational execution of all current FedRAMP Moderate and FedRAMP High authorizations, as well as spearheading our future pursuit of Department of Defense (DoD) authorizations.
As the senior federal security leader within the Product Security organization, you will manage, mentor, and oversee a specialized team, including direct oversight of the Senior Federal Security Analyst & ISSO, who executes the day-to-day hands-on management of these federal authorization programs. This is a high-visibility leadership role requiring a deep understanding of federal cloud computing mandates, continuous monitoring requirements, and the technical architecture of enterprise SaaS platforms.
Key Responsibilities
- Federal Authorization Leadership: Direct the strategic roadmap and operational maintenance for all Qualys federal boundaries, ensuring strict adherence to FedRAMP Moderate and FedRAMP High baseline requirements.
- DoD Expansion Strategy: Lead the architectural, technical, and programmatic readiness efforts required to achieve and maintain future DoD authorizations (IL4/IL5), partnering across engineering and operations to build compliant deployment models.
- Team Leadership & Mentorship: Provide direct management and strategic guidance to the Senior Federal Security Analyst & ISSO, ensuring the effective execution of continuous monitoring (ConMon), POA&M management, and incident response within federal boundaries.
- Audit & Assessment Authority: Serve as the primary executive interface for 3PAO (Third-Party Assessment Organization) audits, Joint Authorization Board (JAB) reviews, and agency sponsor communications.
- Cross-Functional Enablement: Collaborate closely with DevOps, SRE, Platform Engineering, and R&D to ensure that new Qualys products, features, and code releases meet stringent federal compliance mandates prior to deployment in government environments.
- Executive Risk Reporting: Maintain and present comprehensive dashboards and risk metrics regarding the health, status, and resourcing of federal compliance programs to the VP of Product Security, the CISO, and executive stakeholders.
- Boundary & Configuration Control: Oversee the rigorous enforcement of change control, FIPS-validated cryptography requirements, and strict logical/physical boundary isolation standards required by federal frameworks.
Required Qualifications
- Experience: 7+ years of progressive leadership experience in Information Security, Product Security, or Cloud Compliance, with a minimum of 5 years specifically directing FedRAMP and/or DoD (DISA SRG) authorization programs for a SaaS/PaaS provider.
- Regulatory Expertise: Extensive knowledge of NIST SP 800-53, FedRAMP High baselines, DoD Cloud Computing SRG, and FISMA requirements.
- Technical Acumen: Deep understanding of modern cloud architectures, containerization (Kubernetes), microservices, CI/CD pipelines, and the technical implementation of security controls within complex SaaS environments.
- Leadership: Demonstrated experience leading specialized federal security teams and managing internal and external compliance resources.
- Communication: Exceptional executive presence with the ability to translate complex federal technical constraints into actionable business strategies for C-suite leadership and engineering teams.
- Citizenship: Due to the nature of federal compliance requirements, U.S. Citizenship and residence within the United States is strictly required.
Preferred Qualifications
- Active U.S. Security Clearance (Secret or Top Secret) or ability to achieve it.
- Prior experience successfully guiding an organization through DoD authorization processes.
- Industry certifications such as CISSP, CISM, CCSP, or CAP.
- Experience with automated compliance-as-code tooling and modern GRC platforms.
- Experience with DoD authorization accelerator programs and providers a plus.
Qualys is an Equal Opportunity Employer, please see our EEO policy.
Skills Required
- 7+ years of progressive leadership experience in information security, product security, or cloud compliance
- At least 5 years directing FedRAMP and/or DoD DISA SRG authorization programs for a SaaS or PaaS provider
- Extensive knowledge of NIST SP 800-53, FedRAMP High baselines, DoD Cloud Computing SRG, and FISMA requirements
- Deep understanding of cloud architectures, Kubernetes, microservices, CI/CD pipelines, and security controls in SaaS environments
- Experience leading specialized federal security teams and managing internal and external compliance resources
- Exceptional executive communication and ability to translate technical constraints into business strategies
- U.S. citizenship and residence within the United States
- Active U.S. Secret or Top Secret security clearance, or ability to obtain one
- Experience guiding an organization through DoD authorization processes
- CISSP, CISM, CCSP, or CAP certification
- Experience with automated compliance-as-code tooling and modern GRC platforms
- Experience with DoD authorization accelerator programs and providers
Qualys Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Qualys and has not been reviewed or approved by Qualys.
-
Affordable Benefits — Benefits costs are widely viewed as low for employees and dependents, with healthcare often described as almost fully paid for. Feedback suggests this affordability helps offset perceptions of lower base pay in some roles.
-
Healthcare Strength — Healthcare offerings are broad, including multiple medical plan options, dental and vision coverage, mental health support, and disability insurance. Benefits are described as “pretty amazing” or “great,” reinforcing perceived quality and coverage depth.
-
Equity Value & Accessibility — Equity participation is accessible through company stock plans and an employee stock purchase plan. Compensation packages commonly include equity alongside salary and bonus, which some consider a meaningful part of total rewards.
Qualys Insights
What We Do
Qualys, Inc. (NASDAQ: QLYS) is a pioneer and leading provider of disruptive cloud-based security, compliance and IT solutions with more than 10,000 subscription customers worldwide, including a majority of the Forbes Global 100 and Fortune 100. Qualys helps organizations streamline and automate their security and compliance solutions onto a single platform for greater agility, better business outcomes, and substantial cost savings. The Qualys Cloud Platform leverages a single agent to continuously deliver critical security intelligence while enabling enterprises to automate the full spectrum of vulnerability detection, compliance, and protection for IT systems, workloads and web applications across on premises, endpoints, servers, public and private clouds, containers, and mobile devices. Founded in 1999 as one of the first SaaS security companies, Qualys has strategic partnerships and seamlessly integrates its vulnerability management capabilities into security offerings from cloud service providers, including Amazon Web Services, the Google Cloud Platform and Microsoft Azure, along with a number of leading managed service providers and global consulting organizations. For more information, please visit http://www.qualys.com
