5-7 years of experience in classified environments, particularly SAP or similar settings.
Hands-on expertise in infrastructure and platform security, including Linux and network segmentation.
Proficient in translating classified security requirements into actionable technical plans.
Familiarity with NIST 800-53, CNSSI overlays, and STIGs.
Experience in supporting authorization processes for classified systems, including SSPs and control narratives.
Direct collaboration with government security stakeholders and assessors.
Ability to evaluate security architecture tradeoffs independently.
Responsibilities
Define security architectures for classified deployments, focusing on SAP environments.
Translate security requirements into engineering implementation plans.
Collaborate with engineering teams to validate security controls across various domains.
Lead resolution of technical security challenges impacting classified deployments.
Drive technical authorization readiness, including necessary documentation for ATO packages.
Coordinate with customer security stakeholders to validate architectures and resolve findings.
Develop and maintain remediation plans in partnership with engineering teams.
Benefits
100% coverage of medical, dental, and vision insurance
Unlimited PTO and sick leave
Free lunch, snacks, and coffee
Professional Development Stipend
In-office hardware lab with a $250 project stipend
Annual company retreat
12 weeks parental leave
Fertility and family planning support ($15,000 lifetime)
Wellness stipend ($100/month)
$500/year hardware sensor stipend
401(k) plan
Employee-friendly equity terms
In-office work 5 days per week
Full Job Description
About the role
The Classified Security Architect leads security architecture and technical authorization readiness for Nominal's classified deployments, with particular emphasis on Special Access Program (SAP) environments. You'll translate customer security requirements into deployable architectures, engineering controls, and the technical evidence needed to obtain and maintain authorizations.
You'll work directly with government security stakeholders and partner with Engineering, Platform Security, DevSecOps, and Deployability to resolve technical security challenges, establish repeatable deployment patterns, and speed delivery into highly restricted environments. Engineering owns technical implementation. This role owns classified security architecture requirements, technical design guidance, and coordination of technical authorization deliverables, and it calls for hands-on classified deployment expertise, not only accreditation process experience.
What you'll do:
Define security architectures and technical requirements for classified deployments, including SAP environments and other highly restricted customer environments.
Translate customer security requirements, NIST 800-53 controls, applicable CNSSI overlays, STIGs, and program-specific constraints into actionable engineering requirements and implementation plans.
Partner with engineering teams to design and validate security controls across infrastructure, network boundaries, identity and access management, data flows, software delivery, logging, and system monitoring.
Lead resolution of technical security challenges that could impede classified deployments, working directly with customer security stakeholders and internal engineering teams.
Drive technical authorization readiness, including System Security Plan (SSP) content, architecture diagrams, control narratives, supporting evidence, and other artifacts required for ATO packages.
Coordinate with customer ISSMs, assessors, and authorizing stakeholders to validate proposed architectures, resolve security findings, and support authorization decisions.
Develop and maintain Plans of Action and Milestones (POA&Ms), partnering with engineering on remediation planning and technical resolution.
Establish reusable security architectures, controls, documentation, and deployment patterns across classified customer programs.
Maintain security architecture and authorization readiness as software, infrastructure, and customer requirements evolve.
Identify security architecture constraints early in customer engagements and inform technical feasibility, deployment planning, and program timelines.
We're looking for someone with
Demonstrated experience designing, deploying, or securing systems in classified environments, including SAP or similarly restricted environments.
Hands-on technical experience with infrastructure and platform security, including Linux, network segmentation, identity and access management, and secure software delivery.
Experience translating classified security requirements into technical architecture and engineering implementation plans.
Experience supporting authorization of classified systems, including technical contributions to SSPs, control narratives, assessment evidence, and remediation activities.
Experience working directly with government ISSMs, security assessors, and other security stakeholders to resolve technical and authorization challenges.
Ability to independently evaluate security architecture tradeoffs and guide engineering teams toward compliant, technically viable solutions.
This position requires you to currently possess and be able to maintain a U.S. TS/SCI security clearance, in order to meet U.S. regulatory eligibility requirements for the access to classified information associated with this role.
Skills that supercharge us
Direct experience with SAP deployment architectures, program-specific security requirements, and authorization processes.
Experience obtaining and maintaining ATOs across multiple classified programs or customer environments.
Experience with Kubernetes, containerized infrastructure, and modern DevSecOps practices in restricted or disconnected environments.
Government-side accreditation, security engineering, or assessment experience.
Experience establishing reusable security architectures and control implementations across multiple deployments.
Relevant security certifications, such as CISSP, GIAC, or equivalent technical credentials.
Benefits/Perks
100% coverage of medical, dental, and vision insurance
Unlimited PTO and sick leave
Free lunch, snacks, and coffee
Professional Development Stipend
In-office hardware lab with a $250 project stipend
Annual company retreat
12 weeks parental leave
Fertility and family planning ($15,000 lifetime)
Wellness stipend ($100/month)
$500/year hardware sensor stipend
401(k)
Employee-friendly equity terms
In-office 5 days per week
Compensation
The base pay range for this role is $208,000 - $255,000 per year.
