Security Authorization Lead
About the role
Leidos is seeking a Security Authorization Lead to join the Air Traffic Business Area within the Homeland Sector, supporting the development of the Leidos Common Automation Platform (L-CAP). L-CAP is a mission-critical, future-ready automation platform built on a hybrid cloud data mesh architecture, enabling next-generation air traffic management capabilities. We are building with an AI-first engineering mindset, embracing emerging AI capabilities and modern development practices to accelerate delivery, improve software quality, and continuously evolve how we design and build mission-critical systems. This role operates within a SAFe/Agile framework as part of an Agile Release Train (ART) delivering iterative value across the program. This position supports government programs and requires the ability to obtain and maintain a favorable Public Trust investigation. This is a hybrid position requiring 3 days onsite and 2 days working from home, if you are located within a commutable distance (Less than 1 hour's drive one-way during normal traffic) from Gaithersburg, MD; Eagan, MN; or Egg Harbor Township, NJ. However, if you do not reside within a commutable distance, you may be considered for a 100% remote role. In this role, you will own the security authorization lifecycle for L-CAP. You will lead the formal processes required to authorize L-CAP workloads to connect to and operate within government cloud environments, serve as the program’s primary technical interface to FAA security and Authorizing Official organizations, and own the artifact package and control-inheritance position that underpin every authorization decision. This is a delivery-facing compliance leadership role — you will translate authorization requirements into engineering work rather than documenting them after the fact.
But note: some of that repeats schedule info; we might move schedule to its own section. However we can keep schedule info in About the role? Better to separate schedule. We need to avoid duplication. Let's extract schedule specifics: hybrid position requiring 3 days onsite and 2 days WFH if within commutable distance from listed locations; else 100% remote. So schedule section. Thus About the role should be description of role, not schedule. We'll keep schedule separate. Now Responsibilities: list from "What You’ll Do". We'll create- items.
List:
- Lead the government network connection and RMF/ATO authorization process for L-CAP workloads on government-provided cloud infrastructure, including security assessments, architecture reviews, control evidence, and assessor coordination.
- Own and maintain the security authorization package, including architecture briefings, data flow/security boundary diagrams, ports/protocols/services matrices, SBOMs, vulnerability/CVE dispositions, and POA&Ms.
- Define and defend security control inheritance across cloud provider, government platform, and Leidos application layers, maintaining the Customer Responsibility Matrix.
- Serve as the primary interface with government security reviewers, ISSOs, assessors, and Authorizing Official staff.
- Manage the POA&M and continuous monitoring lifecycle, including findings, risk characterization, remediation milestones, closure evidence, and security status reporting.
- Maintain the authorization boundary as architecture evolves, assess security impacts of proposed changes, and translate requirements into actionable engineering backlog items.
- Coordinate cross-ART compliance across four Agile Release Trains to ensure consistent control implementation and evidence quality.
- Support FedRAMP and agency-specific authorization requirements across cloud environments.
- Coordinate personnel security and facility access eligibility with program security and Talent Acquisition.
- Champion an AI-first engineering culture through AI-assisted development, automation, and emerging practices that improve productivity, code quality, testing, and delivery.
Now Requirements: core technical qualifications (mandatory). We'll list as
- .
Items:
- Bachelor’s degree in Cybersecurity, Computer Science, IT, or related field with 6+ years of relevant cybersecurity, compliance, or security authorization experience, or a Master’s degree with 4+ years (additional experience, education and training may be considered in lieu of degree).
- Demonstrated experience leading a federal information system through RMF to ATO or equivalent authorization, including NIST 800-53 Rev. 5 control implementation and assessment.
- Experience developing and defending authorization packages, including SSPs, POA&Ms, Security Assessment Reports, and authorization boundary diagrams.
- Experience with FedRAMP cloud control inheritance, Customer Responsibility Matrices, vulnerability management, CVE disposition, and remediation tracking.
- Experience working directly with government security reviewers, ISSOs, and/or Authorizing Official staff.
- Ability to translate security requirements into actionable engineering backlog items and coordinate compliance across multiple Agile engineering teams.
- Strong technical writing skills with experience producing government-facing security documentation.
- Ability to obtain and maintain a Public Trust and successfully complete required government background investigations.
- U.S. citizenship required, including eligibility for FAA facility and information system access (continuous U.S. residency for at least 3 of the previous 5 years).
Now Qualifications: preferred/desired qualifications.
List:
- CISSP, CGRC (formerly CAP), CISM, or equivalent certification (strongly preferred)
- FAA or aviation-sector security authorization experience, including familiarity with FAA ATO processes and security governance organizations
- Experience with continuous ATO (cATO) or ongoing authorization models
- Experience defining authorization boundaries for Kubernetes and containerized workloads
- Familiarity with FedRAMP High and GovCloud inheritance models
- Security authorization experience for safety-critical or real-time operational systems
- Experience with compliance automation and evidence tooling, including OSCAL, eMASS, Xacta, or equivalent
- Knowledge of software supply chain security, including SBOM, artifact signing, and provenance
- Experience with SAFe or large-scale Agile compliance integration
Now Skills: maybe we could extract technical skills from responsibilities/qualifications, but we might combine with Qualifications. However we need a Skills section only if there is specific content. Could list skills like: RMF/ATO, NIST 800-53, FedRAMP, Customer Responsibility Matrix, POA&M, SBOM, vulnerability management, CVE disposition, Agile/SAFe, AI-first engineering, technical writing, etc. But that may duplicate. Perhaps we can omit Skills section and rely on Qualifications and Responsibilities. The instruction: prefer a few substantive sections over many thin ones. So we could omit Skills if not needed. But we have to include sections only when posting has real specific content. The posting does mention skills implicitly but not a dedicated "Skills" heading. So we can skip Skills.
Benefits: from "Pay And Benefits" section: "Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement." Also maybe more details at link but we shouldn't invent. So we can list those.
Pay: Pay Range $107,900.00 - $195,050.00.
Schedule: hybrid position requiring 3 days onsite and 2 days working from home, if within commutable distance (Less than 1 hour's drive one-way during normal traffic) from Gaithersburg, MD; Eagan, MN; or Egg Harbor Township, NJ. However, if you do not reside within a commutable distance, you may be considered for a 100% remote role.
Now we need to output HTML fragment only, no /. Use
- for lists. Use
for prose. We must not repeat job title. Not include Job ID etc. Let's craft. We'll order sections: About the role, Responsibilities, Requirements, Qualifications, Benefits, Pay, Schedule. Check each for substantive content. About the role: we have paragraph describing role, mission, etc. Ensure we didn't include schedule details. We'll remove schedule sentence from About the role. Let's rewrite About the role without schedule. Original description: "Leidos is seeking a Security Authorization Lead to join the Air Traffic Business Area within the Homeland Sector, supporting the development of the Leidos Common Automation Platform (L-CAP). L-CAP is a mission-critical, future-ready automation platform built on a hybrid cloud data mesh architecture, enabling next-generation air traffic management capabilities. We are building with an AI-first engineering mindset, embracing emerging AI capabilities and modern development practices to accelerate delivery, improve software quality, and continuously evolve how we design and build mission-critical systems. This role operates within a SAFe/Agile framework as part of an Agile Release Train (ART) delivering iterative value across the program. This position supports government programs and requires the ability to obtain and maintain a favorable Public Trust investigation. In this role, you will own the security authorization lifecycle for L-CAP. You will lead the formal processes required to authorize L-CAP workloads to connect to and operate within government cloud environments, serve as the program’s primary technical interface to FAA security and Authorizing Official organizations, and own the artifact package and control-inheritance position that underpin every authorization decision. This is a delivery-facing compliance leadership role — you will translate authorization requirements into engineering work rather than documenting them after the fact." We'll use that. Now Responsibilities list as above. Requirements list as above. Qualifications list as above. Benefits: list items. Pay: single line maybe
Pay Range $107,900.00 - $1
for each section heading. Use
- for lists. Use