Information Security Lead / AWS Security Architect

Swarm Aero is redefining air power, building the largest swarming UAV and the most versatile swarming aircraft network in the world. The company is moving quickly to launch the first aircraft designed specifically for swarming, as well as the Command & Control software to mobilize swarms of thousands of heterogeneous autonomous assets and empower human operators to achieve superhuman results.

The team has created and exited multiple startups, negotiated defense deals worth billions of dollars, and designed and built 30+ novel aircraft, with aerospace experience from Scaled Composites, Airbus, Archer Aviation, Blue Origin, and Boom Supersonic.

Role Overview

Swarm Aero is hiring an Information Security Lead / AWS Security Architect to sit within the IT organization and own the security architecture, documentation, and compliance support needed across their AWS environment and regulated customer deployments.

This is a dedicated IT role. The person will work closely with Legion (which has the most urgent IL5/IL6 deployment needs), but they are not a Legion-owned resource. They will support the existing company-wide Security Service Provider (SSP) and CMMC program while also helping build and maintain the separate Legion-specific security package required for high-side and government cloud deployments.

The right person needs to be comfortable moving between implementation and documentation. This is not just a paperwork role. They need to understand how AWS is architected, how controls are actually implemented, how to produce evidence, how to drive remediation, and how to keep the broader security program aligned as Legion moves into IL5/IL6 environments. This is a remote role, with 1 week onsite in D.C. per month.

Key Responsibilities

Swarm-Wide IT Security and Compliance

• Support and mature Swarm’s existing company-wide SSP and CMMC program.
• Maintain and improve security documentation, policies, procedures, Plan of Actions & Milestones (POA&Ms), audit artifacts, control evidence, and compliance workflows.
• Help ensure company-wide controls remain aligned with NIST 800-171, CMMC, and applicable federal/customer requirements.
• Feed Legion-specific requirements and findings back into the broader IT security and compliance program where appropriate.
• Coordinate with internal stakeholders, external auditors, customer security teams, and government security representatives.

Legion IL5/IL6 Deployment Support

• Work closely with Legion to support IL5/IL6 deployment readiness.
• Help create and maintain the separate Legion-specific SSP, POA&M, remediation framework, implementation evidence, test evidence, Standard Operating Procedures (SOPs), incident response documentation, and customer security artifacts.
• Partner with DevSecOps and Engineering to identify control gaps, document remediation requirements, and track closure.
• Support customer Information System Security Manager (ISSM)/Information System Security Officer (ISSO) conversations and provide documentation/evidence needed for Authorization to Operate (ATO)/Interim Authorization to Test (IATT) or equivalent deployment paths.
• Help Legion move quickly while keeping security, compliance, and IT governance aligned.

AWS Security Architecture and Implementation

• Own Swarm’s AWS security architecture from the IT side.
• Be responsible for the security posture of existing AWS deployments and future regulated AWS environments.
• Review and guide AWS account architecture, Identity and Access Management (IAM), logging, monitoring, encryption, networking, segmentation, backup, vulnerability management, and secure deployment patterns.
• Support AWS GovCloud, IL5/IL6, and other regulated deployment architectures.
• Establish repeatable AWS security baselines that can support Legion and future customer environments.
• Work with DevSecOps and Engineering to ensure implementation matches compliance requirements, not just policy language.

Security Remediation and Continuous Compliance

• Translate compliance findings into actionable remediation work.
• Maintain POA&M/remediation tracking across company-wide and Legion-specific security programs.
• Ensure documentation stays current as AWS configurations, containers, software releases, and security tooling change.
• Support supply-chain risk management, vulnerability management, incident response, and ongoing audit readiness.
• Help create a sustainable operating model where IT, Legion, DevSecOps, and Engineering are aligned on who owns documentation, implementation, evidence, and remediation.

ITAR requirement: To conform to U.S. Government export regulations, the applicant must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.

What We Offer

• Meaningful equity in a high-growth defense technology company
• Competitive base salary commensurate with experience
• Medical, dental, vision, and 401k
• Paid time off (PTO) and paid sick leave
• Monthly wellness stipend
• Daily catered lunch (office)
• Paid parental leave
• Direct impact on a critical national security mission
• A world-class team of engineers and operators solving genuinely hard problems