GovCon Enclave

The problem

Small defense contractors handle Controlled Unclassified Information, and CMMC was turning that responsibility into an audited requirement. The companies that most needed a compliant environment were exactly the ones that could not afford the enterprise answer: a security team, a compliance staff, and a six-figure infrastructure project before the first contract deliverable.

GovCon Enclave was Rimstorm's answer: a turnkey enclave where the security architecture, monitoring, and compliance posture come with the platform, so a small contractor gets an environment for protecting CUI without building a security org first.

My role

I joined Rimstorm as Chief Technology Officer and first technical leader, and I owned GovCon Enclave from concept through acquisition. That meant the product and the architecture, but also everything a founding technical executive owns: hiring, training, compliance strategy, and the operating model that let a small company run a growing fleet of production environments. Where the Mistborn case study is about what I build alone, this one is about what I build through teams.

What I built

A security platform for protecting CUI: infrastructure as code end to end, Kubernetes, a fleet-wide SIEM, and hardened Linux. The defining property is not any single component, and it is not the cloud it runs on: it is that every enclave is deployed, configured, and kept healthy by code. The automation framework I built took enclave deployment from a two-week manual project to a two-hour operation, which changed what the company could promise and what a small team could operate.

That framework is cloud-agnostic by design. The infrastructure layer is kept separate from the platform above it, and we built and ran early enclaves on AWS and Oracle Cloud before standardizing on Azure as the most straightforward path for our first customers. Settling on one provider to start was a practical choice rather than lock-in: because the cloud layer is isolated, the platform could extend to another FedRAMP High cloud without reworking everything above it.

The platform carried Rimstorm through its first independent C3PAO assessment for CMMC Level 2 in December 2025 with a perfect 110 score and zero POA&Ms, scaled to more than fifty production enclaves supporting hundreds of users, and became the core IP behind the company's 2026 acquisition by BOOST LLC, where it continues as the Secure Enclave Platform.

The physical segment

GovCon Enclave started as a cloud environment with virtual desktops. But a compliant platform is only as good as its weakest entry point, and some users need a real, physical machine on a desk rather than a virtual one. The question was whether physical hardware would be an exception to the security model or a part of it.

The answer was an appliance I designed and built that brings a physical workspace inside the enclave's boundary. A physical desktop reaches enclave resources under the same enforced access rules and the same security monitoring as a virtual one, with each client's identity preserved end to end so none of the policy model has to change. A separate management plane, independent of the data path, keeps the appliance reachable and recoverable on its own. The result is that the compliance posture the platform proves in assessment is the same whether the desktop is in the cloud or on a desk: the boundary follows the user, not the hosting model.

Building the teams

The platform was half the job. The other half was building the organization around it: I built up Rimstorm's engineering, development, and maintenance teams, and I kept them deliberately small. The bet was that a few people with deep context and serious automation beat a large roster doing manual work, and the numbers bore it out: deployment effort fell by two orders of magnitude while the enclave count grew past fifty.

Leading them, I worked the way I have led teams since 2015: an open door, candor about what is going well and what is not, credit shared and failures owned by me, and no tolerance for internal competition. Knowledge and judgment carried more authority than titles. People were trained into ownership, not just assigned tasks, so the day-to-day did not route through the CTO. The full philosophy, and where it comes from, is in the leadership essay.

Hard decisions

Five calls that defined the platform and the company's trajectory. Each one was a leadership decision before it was a technical one.

Outcomes

• Acquisition: GovCon Enclave became the core IP behind Rimstorm's 2026 acquisition by BOOST LLC, and I was named Chief Architect for the Secure Enclave Platform after the close.
• Compliance proven independently: the platform's own C3PAO assessment for CMMC Level 2 (December 2025) and its first customer's (May 2026) both passed with perfect 110 scores and zero POA&Ms.
• Scale without lockstep headcount: 50+ production enclaves supporting hundreds of users, operated by deliberately small teams.
• Operational leverage: enclave deployment reduced from 2 weeks to 2 hours through the automation framework.

Lessons I carry forward

• Automation is a leadership decision before it is a technical one: the hard part was holding the line on the investment while the team did rollouts by hand.
• Compliance and architecture have to be one conversation. The moment they split into two meetings, the platform starts accruing paperwork debt.
• Small teams scale on context, not process. People who understand why a control exists make the right call when the runbook runs out.
• Train people into ownership early. The day-to-day only stopped routing through me because the teams were taught to run it, not just build it.

Thinking through a founding-engineer hire?

GovCon Enclave is what that role looks like when it works: design the product, build the platform, hire and train the teams, and hold the line on the decisions that make the whole thing acquirable. If you are working out a hire like that, I am glad to compare notes: what the role actually owns, what separates a founding engineer from a senior engineer with a new title, and how to tell the difference before the offer. I have been that hire, and I have made those hires.