PROGRAM MANAGER – CYBERSECURITY ARCHITECTURE & ENGINEERING

Zermount Inc is seeking a Program Manager to lead a federal cybersecurity architecture and engineering program supporting enterprise security modernization and secure delivery across multiple technical workstreams. In this onsite role based in Arlington, VA, you will coordinate with Government stakeholders, company leadership, and delivery teams to manage schedule, scope, quality, and federal alignment from planning through reporting.

Role Overview

• Lead day-to-day execution of a federal cybersecurity architecture and engineering program, ensuring delivery is completed on schedule, within scope, and in alignment with contract requirements.
• Act as the primary program interface across Government stakeholders, company leadership, technical teams, subcontractors, and mission partners.
• Oversee program scope, staffing, schedule, risks, issues, dependencies, action items, deliverables, and performance reporting.

Program Management and Delivery Artifacts

• Develop and maintain program management artifacts including the Integrated Master Schedule (IMS), sprint plans, deliverable tracker, risk register, issue log, action item register, staffing tracker, and status reports.
• Facilitate Agile delivery activities such as backlog refinement, sprint planning, capacity planning, sprint reviews, retrospectives, and recurring team coordination.
• Ensure all work is tracked in the Government-designated project management or Agile tracking tool.
• Prepare and deliver program status updates, executive briefings, meeting minutes, technical summaries, risk reports, and deliverables for Government review.

Cybersecurity Architecture, Engineering, and Enablement

• Lead cross-functional teams supporting cybersecurity architecture, cloud security, RMF modernization, cATO, DevSecOps, vulnerability management, continuous monitoring, and emerging technology and AI security assessment activities.
• Coordinate development of architecture recommendations, secure design patterns, implementation roadmaps, SOPs, playbooks, dashboards, briefings, and customer-ready deliverables.
• Support cATO implementation activities including automated control assessment, control-to-evidence mapping, evidence collection, continuous monitoring, OSCAL-aligned documentation, and associated authorization-support artifacts.
• Oversee Emerging Technology and AI Security Engineering and Testing activities, including intake, triage, risk-tiering, evidence expectations, decision gates, testing coordination, and risk reporting.
• Ensure emerging technology and AI assessments address security, privacy, data protection, access control, supply chain risk, logging and monitoring, misuse risk, integration risk, and operational impact.

Quality, Risk Management, and Coordination

• Identify risks, blockers, staffing gaps, resource constraints, quality concerns, and schedule impacts early, and recommend practical corrective actions.
• Review deliverables for quality, accuracy, completeness, professionalism, and alignment with customer requirements before submission.
• Support staffing, onboarding, knowledge transfer, team performance, and resource planning.
• Promote a delivery culture focused on accountability, technical quality, customer service, compliance, and mission outcomes.
• The Program Manager may support all task areas, other programs and projects as required by the Executive Team, or perform other similar duties as assigned.

Required Qualifications

• 8+ years of relevant experience supporting IT, cybersecurity, cloud, engineering, or federal technology programs.
• 5+ years of experience managing technical projects, cybersecurity projects, or federal IT/cybersecurity delivery teams.
• Experience managing complex cybersecurity, cloud, enterprise IT, or security engineering programs in a federal contracting environment.
• Experience managing program schedules, staffing, risks, issues, deliverables, status reporting, quality reviews, and client communications.
• Working knowledge of RMF, ATO, cATO, FISMA, NIST guidance, security assessments, and federal cybersecurity requirements.
• Experience coordinating technical teams across cybersecurity architecture, cloud security, infrastructure, application security, identity, DevSecOps, vulnerability management, GRC, or enterprise architecture workstreams.
• Experience leading work in Agile environments including Scrum or Kanban, backlog refinement, sprint planning, team coordination, and retrospectives.
• Strong communication skills with senior Government stakeholders, technical teams, executives, and non-technical audiences.
• Strong writing skills for status reports, meeting minutes, briefings, plans, procedures, and decision-support materials.
• Strong organizational, analytical, problem-solving, and leadership skills.
• Ability to manage multiple priorities, shifting deadlines, complex dependencies, and customer-facing issues.
• Ability to operate with sound judgment, personal accountability, professionalism, and limited supervision.

Preferred Qualifications

• Experience supporting federal civilian, defense, intelligence, or highly regulated cybersecurity programs.
• Experience managing cybersecurity architecture, cATO, RMF automation, GRC integration, cloud security modernization, or DevSecOps programs.
• Experience supporting automated control assessment, control-to-evidence mapping, continuous monitoring dashboards, common controls, inherited controls, or OSCAL-aligned documentation.
• Experience supporting AI, machine learning, generative AI, automation, or emerging technology security assessments.
• Experience developing or managing intake forms, triage rubrics, risk-tiering models, testing playbooks, decision gates, or evidence requirements.
• Experience with tools such as Microsoft Project, Rally, Microsoft 365, Confluence, ServiceNow, Archer, JCAM, RegScale, AWS Audit Manager, Tenable, Splunk, QRadar, Axonius, Prisma Cloud, Okta, Microsoft Defender, or similar platforms.

Technologies and Technical Knowledge

• Cybersecurity architecture and security engineering, including RMF, ATO, cATO, and FISMA aligned to NIST SP 800-37, NIST SP 800-53, and NIST SP 800-53A.
• Cloud security architecture and shared responsibility models across hybrid and multi-cloud environments.
• AWS security services such as Security Hub, Config, GuardDuty, CloudTrail, CloudWatch, IAM, KMS, Lambda, plus similar services.
• Azure security services such as Entra ID, Key Vault, Azure Policy, Defender for Cloud, Monitor, Log Analytics, plus similar services.
• DevSecOps and CI/CD security, automated security scanning, evidence automation, SBOM, SAST, DAST, SCA, IaC scanning, and container security.
• Vulnerability management, configuration management, continuous monitoring, security telemetry, and SIEM/SOC integration.
• Identity and access management including Okta and Microsoft Entra ID (or similar platforms).
• CMDB, asset inventory, GRC workflows, inherited controls, common controls, and evidence repositories.
• Zero Trust concepts and related governance and risk frameworks including SCRM, ICAM, SASE, CASB, and TIC 3.0.
• Emerging technology and AI security risk evaluation including intake, triage, testing, evidence collection, and decision-support processes.
• Technologies referenced include RMF, ATO, cATO, FISMA, NIST SP 800-37, NIST SP 800-53, NIST SP 800-53A, AWS Security Hub, AWS Config, AWS GuardDuty, AWS CloudTrail, AWS CloudWatch, AWS IAM, AWS KMS, AWS Lambda, Azure Entra ID, Azure Key Vault, Azure Policy, Defender for Cloud, Azure Monitor, Log Analytics, DevSecOps, CI/CD, SBOM, SAST, DAST, SCA, IaC scanning, container security, SIEM/SOC, Okta, Microsoft Entra ID, CMDB, GRC, Zero Trust, SCRM, ICAM, SASE, CASB, TIC 3.0, OSCAL.

Certifications and Clearance

• PMP (required)
• Agile/Scrum Master (required)
• ITIL (preferred)
• At least one required certification from: CISSP, CISM, CISA, AWS Solution Architect, Azure Solution Architect, GCP Solution Architect, or similar certification approved by Management
• Minimum clearance: Public Trust

Location and Schedule

• Location: Arlington, VA (onsite). Remote work is authorized.
• Primary locations: Arlington and Alexandria, VA. Occasional travel to the primary locations will be required.
• Core hours: 6:00 am ET to 6:00 pm ET

Compensation: USD 130,000 - 190,000 per year.

Experience requirement: 8 years minimum.

Education: Bachelor’s degree or higher in computer science, Information Technology, Information Security, Management, Business Administration, or related field (as listed).