• Own the full lifecycle of personnel security clearances — initiations, sponsorships, reinvestigations, and terminations — using DISS/NBIS. • Serve as the primary liaison with DCSA (Defense Counterintelligence and Security Agency) and other cognizant security authorities. • Conduct security briefings, debriefings, foreign travel briefings, and annual security awareness training for cleared staff. • Maintain accurate records of cleared employees, visitor certifications, and foreign national contacts. • Manage and maintain AppGate's Facility Clearance (FCL) in accordance with DCSA guidance and NISPOM (32 CFR Part 117). • Oversee physical security controls including access management, classified storage, open storage areas, and classified destruction procedures. • Conduct and document periodic self-inspections; develop and track corrective action plans. • Manage classified visit certifications and coordinate cleared personnel access to government and contractor facilities. • Ensure proper handling, transmission, storage, and disposition of classified information and Controlled Unclassified Information (CUI). • Support program managers in reviewing DD Form 254s (Contract Security Classification Specifications) for new and existing contracts. • Partner with AppGate's IT and DevSecOps teams to ensure classified and sensitive program environments meet applicable security requirements. • Interface with government Program Security Officers (PSOs) on program-specific security requirements and deliverables. • Maintain compliance with NISPOM, ITAR, EAR, and relevant federal security directives across all cleared programs. • Develop and enforce security policies, procedures, and SOPs tailored to a software product company environment. • Investigate and report security incidents and violations to DCSA and appropriate authorities; drive root cause analysis and remediation. • Support CMMC assessments, government inspections, and contract-driven security audits. • Stay current on evolving federal security regulations and proactively update AppGate's security program accordingly.

• Act as engagement lead on customer engagements • Communicate project roles and responsibilities to project team members while planning, monitoring, appraising, and reviewing project objectives. • Enforce policies and procedures for each project • Achieve operational objectives by: • Contributing information and recommendations to strategic plans and reviews • Preparing and completing action plans • Implementing production, productivity, quality, and client-service standards • Resolving problems • Determining system improvements • Implementing change • Meet financial objectives by forecasting requirements, quoting services, scheduling expenditures, analyzing variances, and initiating corrective actions. • Lead delivery of cybersecurity projects in identity, access, and data protection domains, including assessments, design, implementation, migration, remediation, and operationalization efforts. • Update job knowledge by participating in educational opportunities, reading professional publications, maintaining personal networks, and participating in professional organizations. • Coordinate project execution across consultants, architects, engineers, customer stakeholders, and partner vendors to ensure delivery quality, milestone attainment, and issue resolution. • Manage RAID logs, project dependencies, change control, decision tracking, and executive status reporting for security engagements. • Drive client governance cadences, including kickoff sessions, status meetings, risk reviews, steering updates, and acceptance/sign-off checkpoints. • Ensure projects follow repeatable delivery standards, documentation requirements, evidence collection expectations, and quality gates. • Partner with technical leads to align delivery plans to security controls, testing, cutover, validation, and post-implementation support needs. • Manage multiple concurrent security engagements and shared resources across pods or workstreams while maintaining schedule and risk governance. • Enhance departmental and organizational reputation by accepting ownership for accomplishing new and different requests while exploring opportunities to add value to job accomplishments. • Develop budgets and track budget expenses. • Provide performance management feedback for project aligned resources based on project observations. • Staff projects appropriately and supervise team members. • Manage team members in a proficient and effective manner • Promote process improvement. • Must pursue professional self-development opportunities on a regular basis.

• Design and maintain enterprise cybersecurity architecture across cloud, network, identity, application, endpoint, and data security domains. • Develop security standards, reference architectures, design patterns, and technical guardrails for enterprise systems. • Partner with engineering teams to ensure security is integrated into new and existing technology solutions. • Review architecture diagrams, technical designs, and implementation plans to identify security risks and recommend improvements. • Lead security architecture efforts for cloud platforms such as AWS, Azure, or Google Cloud. • Define and support security controls for identity and access management, zero trust, encryption, vulnerability management, endpoint protection, logging, and monitoring. • Evaluate emerging threats, technologies, and business requirements to recommend appropriate security solutions. • Support security risk assessments, threat modeling, and control validation activities. • Collaborate with Governance, Risk, and Compliance teams to align architecture with regulatory and industry frameworks such as NIST, ISO 27001, CIS, SOC 2, or similar. • Provide technical guidance during incident response, security investigations, and remediation planning. • Assess third-party tools, platforms, and vendors from a security architecture perspective. • Mentor security engineers, IT teams, and application teams on secure design principles and best practices. • Create clear documentation, diagrams, and executive-ready recommendations for technical and non-technical audiences.

• Conduct comprehensive risk assessments of cloud infrastructure, gaming applications, CI/CD pipelines, DevOps processes, payment processing systems, and all other aspects of internal technology operations • Develop and maintain risk registers, threat models, vulnerability and threat management programs, and risk treatment plans across eight enterprise risk categories • Perform quantitative and qualitative risk analysis using industry-standard methodologies (ISO 27005, ISO 31000, NIST RMF) • Evaluate third-party vendor security risks and assess supply chain vulnerabilities using structured TPRM frameworks • Leverage AI tools to accelerate risk identification, analysis, and reporting workflows • Develop and recommend risk mitigation strategies and security controls • Collaborate with technical teams to implement security measures and monitor their effectiveness • Track remediation efforts and verify risk reduction activities via GRC platform integrations • Create and maintain risk metrics and key risk indicators (KRIs) • Ensure alignment with regulatory and industry requirements including state-specific gaming regulations (GLI-19, GLI-33, GLI-GSF), ISO 27001, ISO 42001, PCI DSS v4.0, SOC 2, NIST CSF, and GDPR • Support internal and external audits (Deloitte, Bulletproof, Schellman) by gathering evidence, preparing documentation, and coordinating audit activities • Maintain security policies, procedures, and risk management frameworks within the IMS • Contribute to AI governance activities including AI service registry maintenance, Shadow AI detection, and ISO 42001 compliance • Identify opportunities to extend agentic automation by integrating new MCP servers and APIs into existing AI workflows, reducing manual effort across compliance, audit, and risk operations • Prepare risk reports and dashboards for management, audit committees, and gaming regulators • Document risk assessment methodologies and maintain assessment artifacts.