About this role.
Oddball is hiring an ATO Specialist to own the security authorization, reauthorization, and continuous-monitoring lifecycle for a VA veteran-facing chatbot and voicebot system. The role leads federal RMF compliance activities, maintains audit-ready security and privacy documentation, and coordinates assessments and remediation. It partners closely with engineering, program leadership, and VA stakeholders to ensure controls are implemented and evidenced effectively. Strong experience with ATO processes, SSPs, POA&Ms, SARs, PIAs, and Zero Trust Architecture is required. The position is fully remote for applicants authorized to work in the United States.
Role DNA
A quick view of the complexity, pace, ownership and collaboration implied by the job description.
Job Complexity
4/5Pace & Pressure
4/5Autonomy Level
5/5Communication Load
5/5Salary analysis
Estimated compensation compared with the broader US market for similar roles.
Core skills
Skills and capabilities most closely associated with this opportunity.
Sample interview questions
I begin by confirming the system boundary, data types, authorization requirements, and control baseline. I build a documentation and evidence plan with clear owners and milestones, coordinate control implementation and assessment activities, manage POA&M remediation, and maintain continuous-monitoring artifacts after authorization.
I integrate SSP updates into the change-management process so material architectural, hosting, interface, or control changes trigger a review. I work with engineering to validate control narratives and evidence, track updates in a controlled repository, and periodically reconcile the SSP against the current environment.
I document the finding, affected control, risk, root cause, remediation owner, milestones, and required validation evidence. I hold regular status reviews, escalate blocked high-risk items, verify remediation with objective evidence, and ensure closure decisions are traceable and approved.
I would translate the principles into implementable practices such as strong identity controls, least privilege, device and workload posture checks, segmentation, encryption, centralized logging, and continuous verification. I would map those practices to applicable controls and collaborate on a practical implementation sequence that supports delivery timelines.
I start with the assessment scope and control inventory, then conduct an evidence-readiness review with control owners. I validate that artifacts are current, reproducible, and tied to the implemented system; conduct mock interviews or walkthroughs when useful; and maintain a tracker for gaps, owners, due dates, and final responses.
Oddball believes that the best products are built when companies understand and value the things they are working on. We value learning and growth and the ability to make a big impact at a small company. We believe that we can make big changes happen and improve the daily lives of millions of people by bringing quality software to the federal space.
We are seeking an experienced ATO Specialist to lead security authorization and compliance efforts for the VA Chatbot program. In this role, you’ll own and drive the Authority to Operate (ATO) lifecycle for a veteran-facing system, partnering closely with engineering, program leadership, and government stakeholders to maintain a strong, audit-ready security posture while supporting ongoing delivery.
What you’ll be doing:
- Lead and manage the ATO, reauthorization, and Continuous Monitoring lifecycle for the VA Voicebot system
- Serve as the primary security point of contact for the program, coordinating with VA stakeholders and internal leadership
- Prepare, maintain, and update required security and privacy artifacts, including System Security Plans (SSPs), Plans of Action and Milestones (POA&Ms), Security Assessment Reports (SARs), Privacy Impact Assessments (PIAs), and supporting evidence
- Partner with engineering and program management teams to ensure security controls are properly implemented, documented, and maintained in alignment with RMF and VA security policy
- Coordinate control assessments, evidence collection, and responses to audit or assessment findings
- Advocate for and support adoption of security best practices, including Zero Trust Architecture (ZTA) concepts, to strengthen the platform’s overall security posture
What you’ll bring:
- Proven experience leading ATO processes for federal information systems
- Strong working knowledge of the Risk Management Framework (RMF) and federal security requirements
- Demonstrated experience producing and maintaining federal security documentation, including SSPs, POA&Ms, PIAs, and SARs
- Familiarity with Zero Trust Architecture principles and how they apply within federal systems
- Performs other related duties as assigned.
Requirements:
- Applicants must be authorized to work in the United States. In alignment with federal contract requirements, certain roles may also require U.S. citizenship and the ability to obtain and maintain a federal background investigation and/or a security clearance.
Education:
- Bachelor’s degree
Benefits:
- Fully remote
- Yearly stipend
- Comprehensive Benefits Package
- Company Match 401(k) plan
- Flexible PTO, Paid Holidays
Oddball is an Equal Opportunity Employer and does not discriminate against applicants based on race, religion, color, disability, medical condition, legally protected genetic information, national origin, gender, sexual orientation, marital status, gender identity or expression, sex (including pregnancy, childbirth or related medical conditions), age, veteran status or other legally protected characteristics. Any applicant with a mental or physical disability who requires an accommodation during the application process should contact an Oddball HR representative to request such an accommodation by emailing hello@Oddball.io
Compensation:
At Oddball, it’s important each employee is compensated competitively and fairly. In alignment with state legal requirements. A range for the included position is listed below. Be advised, actual offer details are determined by job category, job location, and candidate skill level.
United States Wage Range: $100,000 – $140,000
Upload your resume now
- To unlock remote work opportunities and be discovered by global employers.
This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content.
