• Define and execute the ATO pathway, including responsibility allocation across government and contractor teams • Author and maintain RMF documentation (SSP, SAP, SCTM, ConMon) in accordance with DoDI 8510.01 and NIST 800-53 • Coordinate with eMASS and Authorizing Officials on assessment and authorization activities • Lead continuous monitoring and reauthorization efforts across the system lifecycle • Define security requirements for cross-domain data flows (IL-5, IL-6, tactical edge) • Evaluate and guide selection of DoD-approved cross-domain solutions • Ensure classification-aware data segmentation is enforceable, auditable, and aligned with policy (e.g., NOFORN, REL_TO, ORCON) • Review system architecture to ensure compliant handling of classified data flows • Support secure operation across NIPR, SIPR, and higher classification environments • Define authorization approaches (inheritance vs. standalone ATOs) across enclaves • Maintain alignment with evolving joint and service-level security requirements

• Review and help design robust security standards and monitoring • Maintain and improve our policy-as-code platform to enable rapid detection and response • Work closely with our Infrastructure team to ensure cloud-based deployments have proper monitoring and adhere to our policies • Manage SOC II audits, set a high standard for compliant software and processes, and ensure we consistently meet those standards • Participate in on-call rotation to support critical security issues • Own the vulnerability disclosure program and triage inbound reports to security@ • Run periodic tabletop exercises and incident response drills • Maintain security policies and lead recurring reviews (e.g., firewall changes, security reviews) • Lead responses to partner and customer security questionnaires • Maintain the security risk register, track remediation, and produce periodic security metrics for leadership

• Manage user identities, roles, and access rights across IAM platforms and Active Directory. • Handle ServiceNow tickets related to IAM access requests, incidents, and changes. • Provision, modify, and deprovision access in IAM tools, systems, and local servers. • Provide administrative support including account unlocks, password resets, and remote access provisioning. • Act as last-level support for ATA-operated IAM solutions. • Collaborate closely with IAM operations teams, stakeholders, and customers. • Prepare and deliver weekly and monthly IAM service status reports. • Support internal and external audits by providing evidence and representing the IAM administration team.

• Conduct application security assessments to identify and mitigate potential security risks. • Analyse software systems to identify potential threats and vulnerabilities. • Create and maintain threat models that outline potential attack vectors. • Collaborate with development teams to remediate identified vulnerabilities. • Validate threat models against industry standards. • Document findings from threat modelling assessments. • Review code written by developers to identify security flaws. • Perform various security tests, including SAST and DAST. • Provide technical guidance for application onboarding activities. • Work closely with development teams, product managers, and other stakeholders to gather information. • Design and implement process improvements for the Application Security program.