• Serve as a trusted security advisor to system owners, business owners, and technical teams • Guide systems through the Risk Management Framework (RMF) and support their Authority to Operate (ATO) • Develop and maintain authorization documentation, continuous monitoring strategies, contingency planning, and security guidance • Ensure client systems remain compliant with federal cybersecurity requirements • Support authorization package development while maintaining appropriate independence from formal Security Control Assessment (SCA) and Final Assessment Report (SAR) validation activities • Create foundational system documentation, including Boundary Scope Memorandums (BSM), System Architecture diagrams, and Authorization Boundary and Network Diagrams (ABND) • Validate technical evidence, including configuration artifacts, scan reports, and system documentation, to ensure compliance • Develop and maintain system-level Contingency Plans (CP), Incident Response Plans (IRP), and Continuous Monitoring (ConMon) Plans • Facilitate RMF training sessions, office hours, and user guidance

• Support security design and installation projects throughout the Bay Area • Manage all aspects of the project from initial engagement through project completion • Manage multiple projects and scopes of work • Identify project schedule, scope parameters, and oversee security design and implementation per client design requirements and standards • Manage early project initiation activities and develop project security scope, schedule, critical deliverables, and requirements • Manage scheduling, status, and tracking of critical project tasks, issues, and deliverables • Prepare, issue, and manage Request for Proposal (RFP) documents for security systems installation scope • Evaluate RFP responses and prepare evaluation reports

• Serve as the organization’s primary security leader and trusted advisor, performing many of the responsibilities typically associated with a CISO while partnering with executive leadership on security strategy and execution. • Develop, implement, and maintain pragmatic, right-sized security policies, standards, and best practices working with the developers as customers. • Manage relationships with external vendors, consultants, and auditors. • Lead all Corporate IT functions supporting a fully remote global workforce. • Manage identity and access management, endpoint management, collaboration platforms, SaaS applications, and the employee technology lifecycle (onboarding, offboarding, provisioning). • Establish scalable IT processes that support employee productivity and business continuity, and drive continuous improvement of IT service delivery and employee experience. • Drive pending infrastructure decisions, including VPN strategy, password management, tooling platform consolidation, and certificate lifecycle automation. • Partner closely with Engineering and Platform teams to remove technical blockers and improve operational effectiveness, including CI/CD, automation, and cloud platform reliability. • Identify opportunities to leverage AI and automation to eliminate manual processes and operational toil across the organization. • Evaluate and implement AI-enabled tools that improve productivity, support operations, engineering workflows, security monitoring, and business processes. • Establish governance and best practices for responsible AI usage within the company. • Partner with the COO and leadership team to manage IT, infrastructure, security, and cloud-related budgets, including AI tooling spend. • Monitor and optimize spending across cloud providers, SaaS platforms, security tools, and technology vendors.

• This role is responsible for leading Nasstar’s compliance with the Telecoms Security Act (TSA) and associated Ofcom regulatory requirements, ensuring the organisation can evidence a robust and defensible security posture. • As a key member of the Risk & Compliance function, this role operates at the intersection of regulation and technology, partnering closely with engineering, security, and operational teams to translate regulatory expectations into practical, real-world control effectiveness. • This is a high-impact role with visibility across senior stakeholders and direct relevance to the protection of critical national infrastructure.