• Advise security and technical clients on storytelling and market navigation. • Build credibility with key audiences. • Shape strategy and pressure-test messaging. • Build reporter relationships and drive execution across various projects such as launches and thought leadership.

• Lead status reporting and executive communications, producing clear, executive-ready updates • Manage the coordination of deliverables across multiple P&T priority programs • Drive cross-functional execution and alignment, ensuring dependencies, prerequisites, and critical deliverables are identified, tracked, and delivered on time • Manage financial planning and tracking across security workstreams • Coordinate delivery across internal teams, product teams, vendors, and service providers • Facilitate meetings, driving accountability, and ensure clear documentation of actions, timelines, and outcomes • Proactively identify and escalate risks, gaps, and delivery blockers

• Lead client engagements and project execution providing information security consultation and assessment services, helping our clients meet their compliance obligations by evaluating their business, technology, and operations against industry security standards • Educate, mentor, advise, and share your expertise with clients and colleagues to aid in making decisions on topics like Artificial Intelligence, organizational security strategy and services scope as well provide consultative guidance on complex projects • Providing clear, organized findings and recommendations to clients and tracking progress towards resolution and compliance • Consult/advise with C-level Security Leaders (CISO, CSO, CIO, etc.) and the Board of Directors with our most valued and strategic clients • Develop strategic, operational, and tactical recommendations tailored to each client with the intent to improve a client’s security posture and compliance position • Create detailed strategic security roadmaps with short-term, mid-term, and long-term goals that prioritize remediation recommendations and address all instances of non-compliance with applicable regulatory, statutory, contractual, and organizational obligations • Lead large security engagements in concert with other cybersecurity practices and Presidio teams • Develop security policies, standards, and procedures that are custom-tailored to each client’s unique culture, security goals, and organizational objectives using industry best practices and compliance requirements • Review, analyze, and assess key factors, including inherent risk, mitigating controls, business impact, likelihood and other key elements to determine organizational security risk • Ensure and assess client alignment to, and/or compliance with, applicable regulatory, federal, state, local, contractual, and organizational requirements and best practices standards such as ISO 27001, NIST Cyber Security Framework (CSF), PCI DSS, HIPAA, FERPA, NIST 800-171, CMMC, etc. • Work closely with organizations to conduct security program development by establishing the foundation for a best of breed security program architecture reference model using industry frameworks and standards such as ISO 27001, NIST 800-53, NIST CSF, etc. • Work with other seasoned Principal Security Consultants in a collaborative setting to support and assist on the execution and delivery of key services such as Cloud Governance, Advisory Services, security program development, documentation review, and security consulting services • Execute tabletop exercises after collaborating with client stakeholders to select the scenario then create an After-Action Report • Deliver PCI Advisory Services, including PCI Gap Analysis, SAQs, ROCs and AOCs • Deliver CMMC Advisory Services, including CMMC Readiness Assessments • Assist leadership in cybersecurity administrative functions, such as documentation maintenance, documentation creation, peer review, and other internal cybersecurity activities

Role Description At Lumen, the Lead Information Security Engineer owns the development, maintenance, and defensibility of the security authorization package for assigned systems, ensuring compliance with federal requirements and readiness for assessment. In this role, you apply and refine your RMF expertise through end-to-end execution, working directly with customers and stakeholders to validate controls, surface risk, and drive remediation. Your impact is measured through the successful sustainment of Authorization to Operate (ATO) outcomes, the strength of the system’s security posture, and the ability to support secure, compliant delivery of mission-critical services. The Lead ISSO may operate independently for smaller or less complex environments or in alignment with a Senior Lead (ISSM) for larger programs. The successful candidate will demonstrate the ability to: - Serve as the primary ISSO for assigned systems, accountable for end-to-end RMF execution and ATO outcomes - Execute the full RMF lifecycle, including categorization, control implementation, assessment readiness, authorization support, and continuous monitoring - Develop, maintain, and ensure accuracy of authorization artifacts (e.g., SSP, POA&M, control evidence) - Ensure systems remain ATO-compliant, audit-ready, and aligned with federal requirements (e.g., FedRAMP, FISMA, DoD) - Track, prioritize, and drive remediation of vulnerabilities, audit findings, and control deficiencies - Provide system-level risk assessments and actionable recommendations, including impact and remediation considerations - Monitor vulnerability, audit, and continuous monitoring data to maintain awareness of system risk posture - Coordinate with engineering, operations, and program teams to ensure security controls are implemented effectively and sustainably - Support security assessments, audits, and inspections as the ISSO representative, including direct interaction with assessors and customer stakeholders - Evaluate products, services, and proposed architectures for compliance, risk, and implementation feasibility within customer authorization environments - Support customer integration of managed services by defining control responsibilities, inheritance boundaries, and implementation expectations - Provide input grounded in RMF execution and ATO processes to support solution design, capture efforts, and delivery alignment Qualifications - Bachelor’s degree in information assurance, cybersecurity, or a related field, or equivalent experience - Minimum of 5 years of relevant experience in information assurance, with demonstrated responsibility for RMF execution and ATO support - Proven experience developing and maintaining authorization artifacts (e.g., SSP, POA&M) and supporting security assessments - Experience operating in customer-facing or services-based environments supporting federal or regulated clients is strongly preferred - Relevant certifications in governance, risk, and compliance (e.g., CGRC, CISA) are strongly preferred or equivalent demonstrated RMF experience - Broad security certifications (e.g., CISSP, CCSP) are preferred and may supplement GRC experience - Proficiency with technologies, tools, and processes supporting GRC, vulnerability management, and continuous monitoring Requirements - Strong working knowledge of NIST RMF (SP 800-37) and NIST SP 800-53 control framework - Demonstrated experience executing RMF activities and supporting or leading ATO outcomes for federal or DoD systems - Experience with FedRAMP and/or FISMA authorization processes, including artifact development and assessment readiness - Ability to independently execute RMF activities and manage system-level security posture with minimal oversight - Strong understanding of control implementation, inheritance, and shared responsibility models within complex or hybrid environments - Ability to assess and communicate security risk in complex architectures, translating regulatory requirements into actionable guidance - Experience evaluating security, compliance, and delivery feasibility of products, services, and architectures - Working knowledge of cryptographic principles and emerging standards, including post-quantum cryptography (PQC), and ability to assess vendor solutions for compliance, risk, and implementation considerations - Strong collaboration skills across engineering, operations, program management, and security teams - Effective written and verbal communication skills for both technical and non-technical audiences - Demonstrates Lumen leadership behaviors (teamwork, trust, transparency, clarity, courage, customer focus, growth mindset, respect) Benefits - Comprehensive package featuring a broad range of Health, Life, Voluntary Lifestyle benefits and other perks that enhance your physical, mental, emotional and financial wellbeing