Washington, DC onsite with a mission-focused role supporting an independent federal agency client. This position centers on directing day-to-day cybersecurity operations, continuous monitoring, and incident response, aligned to federal requirements including FISMA, NIST, Zero Trust, and Continuous Diagnostics and Mitigation (CDM). You will operate under the Agency CIO Program Management Office (PMO) while helping safeguard an enterprise IT environment supporting approximately 150 users and 35 systems with active ATO packages at a FIPS 199 Moderate impact level.
What You’ll Do
- Provide real-time monitoring of security events, logs, and alerts across workstations, mobile endpoints, and servers using Microsoft Sentinel and Microsoft Defender to maintain operational situational awareness.
- Lead incident response and escalation workflows in accordance with strict federal performance standards.
- Manage vulnerability scanning and analysis with Qualys, coordinating with infrastructure teams to enforce remediation timelines.
- Support agency participation in DHS CDM DEFEND, maintaining continuous feeds to federal dashboards, meeting a 72-hour reporting latency target, and achieving =95% sensor coverage.
- Coordinate Microsoft 365 E5/G5 security controls, including Microsoft Purview DLP configuration, Defender policies, and mobile threat visibility using Lookout MTD and Microsoft Intune.
- Support RMF and SA&A lifecycles across 35 system packages, sustaining 100% ATO compliance and maintaining =95% audit evidence freshness.
- Author and deliver contractual cybersecurity artifacts, including Monthly Threat Reports, Monthly Plans of Action and POA&Ms, and Quarterly CDM Integration Status Reports.
- Enforce privileged user controls with Microsoft Privileged Identity Management (PAM) and monitor system configurations to mitigate insider risk and unauthorized access.
- Deliver operational cross-functional support for IT risk assessments, audit readiness reviews, and configuration baselines with =95% secure baseline adherence.
Required Experience & Credentials
- United States citizenship with proof of Citizenship provided if selected.
- Minimum 8 years of specialized experience in cybersecurity operations, incident response, or SOC environments.
- Minimum 5 years demonstrating experience supporting federal cybersecurity programs.
- Proven ability to configure and analyze security events in enterprise SIEM platforms, specifically Microsoft Sentinel, including log analysis and security event correlation.
- Hands-on experience conducting vulnerability analysis, configuration auditing, and remediation tracking using enterprise scanning tools such as Qualys.
- Active CISSP credential (or an equivalent recognized industry cybersecurity certification).
Technologies You’ll Work With
Microsoft Sentinel, Microsoft Defender, Qualys, DHS CDM DEFEND, Microsoft 365 E5/G5, Microsoft Purview DLP, Lookout MTD, Microsoft Intune, RMF, SA&A, Microsoft Privileged Identity Management (PAM), FISMA, NIST guidelines, Zero Trust architecture, NIST SP 800-53 Rev. 5, NIST SP 800-37, NIST SP 800-61, OMB Memorandum M-21-31, ServiceNow, and related certifications including GIAC and Microsoft Security Operations Analyst Associate (SC-200), plus CompTIA Security+ and FIPS 199.
Compensation & Work Details
Salary: USD 170,000 - 190,000 per year, commensurate with experience.
Schedule: Fully onsite. Potential for a hybrid schedule with COR approval; exact details will be finalized post-award.
Location: Washington, DC.
Contingencies: This position is contingent upon successful award of a government contract and subsequent government approval.
Benefits
- Health, dental, and vision insurance
- Group and voluntary life insurance
- Short-term and long-term disability insurance
- 401(k) retirement plan with company matching contributions
- Flexible spending accounts
- Generous paid leave policy, including federal holidays
- Professional development opportunities
- Tuition assistance program
Clearance Requirement
Must successfully obtain a favorably adjudicated Tier 2 Public Trust background investigation.
Additional Notes
- No recruitment agencies, please.
- Commitment to equality: applications are welcome from all qualified individuals regardless of age, race, color, religion, sex, sexual orientation, gender identity, national origin, disability status, veteran status, or any other protected status under applicable federal, state, or local laws.
Preferred Qualifications include a Bachelor’s or Master’s degree in Cybersecurity, Information Assurance, Computer Science, or an IT discipline; prior administration of Microsoft 365 E5/G5 security workloads (including Defender for Endpoint, Defender for Cloud Apps, Purview DLP, and Intune); operational familiarity with DHS CDM DEFEND F (or CDMaaS for small agencies) feeds and federal dashboard integrations; advanced credentials such as GCIH, GCIA, SC-200, or CompTIA Security+; working knowledge of ServiceNow; and in-depth understanding of NIST SP 800-53 Rev. 5, NIST SP 800-37 (RMF), NIST SP 800-61 (incident handling), and OMB Memorandum M-21-31 event logging tiers.
