Security Policy and Compliance Lead

Koniag Government Services; Washington (District of Columbia); On-site; USD 160,000 - 220,000; Full time

Benefits offered by this job

Medical Insurance

Dental Insurance

Vision Insurance

401(k)

Paid Time Off

Parental Leave

Life Insurance

Disability Insurance

FSAs

Commuter Benefits

Tuition Reimbursement

Job summary

Koniag Operations Services, LLC (KOS) is seeking a Security Policy and Compliance Lead to support SBA in Washington, DC. This role requires the candidate to be able to obtain a Public Trust.

The ideal candidate is a seasoned cybersecurity professional with deep expertise in federal security policy development, compliance program management, and the application of federal cybersecurity frameworks within complex federal government environments.

Qualifications

• Experience developing and managing federal security policy and compliance programs.
• Deep knowledge of NIST, FISMA, OMB directives and CISA guidance.
• Ability to obtain a Public Trust and operate in complex government environments.

Responsibilities

• Lead SBA security policy and compliance programs, providing strategic direction and hands‑on leadership.
• Develop, review, and maintain cybersecurity policy framework aligned with federal requirements.
• Oversee compliance programs ensuring IT systems meet regulatory obligations and risk tolerances.
• Lead RMF activities across SBA's system portfolio and coordinate continuous monitoring.

Job description

Koniag Operations Services, LLC (KOS), a Koniag Government Services company is seeking a Security Policy and Compliance Lead to support KOS and our government customer in Washington, DC. This position requires the candidate to be able to obtain a Public Trust.

Benefits include medical, dental, and vision insurance, 401(k) retirement plan, paid time off, paid parental leave, life and disability insurance, flexible spending accounts, commuter benefits, and tuition reimbursement.

We are seeking an experienced Security Policy and Compliance Lead to support the U.S. Small Business Administration (SBA). The ideal candidate is a seasoned cybersecurity professional with deep expertise in federal security policy development, compliance program management, and the application of federal cybersecurity frameworks and regulations within complex federal government environments. This individual will serve as the primary subject matter expert (SME) for security policy and compliance activities at the SBA, providing strategic guidance, technical leadership, and hands‑on program management to ensure the agency's cybersecurity policies, procedures, and practices align with applicable federal laws, regulations, executive orders, and industry best practices.

The Security Policy and Compliance Lead will serve as the senior expert responsible for leading and managing SBA's security policy and compliance programs, ensuring the agency's cybersecurity posture aligns with federal security requirements, regulatory obligations, and organizational risk tolerance.

Principal responsibilities will include but are not limited to:

• Serve as the primary subject matter expert (SME) and program lead for SBA's security policy and compliance programs, providing strategic direction, technical guidance, and hands‑on leadership to ensure the agency's cybersecurity policies, procedures, and practices meet all applicable federal security requirements and regulatory obligations.
• Lead the development, review, maintenance, and continuous improvement of SBA's cybersecurity policy framework, including agency-wide security policies, standards, procedures, guidelines, and baselines, ensuring alignment with NIST, FISMA, OMB, and CISA requirements and directives.
• Oversee and manage SBA's compliance program, ensuring the agency's IT systems, security controls, and operational practices comply with applicable federal cybersecurity laws, regulations, executive orders, and OMB mandates, including FISMA, OMB Circular A-130, and relevant CISA Binding Operational Directives (BODs) and Emergency Directives (EDs).
• Lead and support the NIST Risk Management Framework (RMF) process across SBA's system portfolio, providing expert guidance on security categorization, control selection, implementation, assessment, authorization, and continuous monitoring activities.
• Develop, maintain, and continuously improve SBA's continuous monitoring program, including the development of monitoring strategies, assessment schedules, and reporting mechanisms to track the ongoing security posture of SBA's information systems and