Virginia

Cybersecurity Jobs in Virginia

354 jobs found

Include remote jobs

Today

Cybersecurity Operations Specialist

MANTECH McLean, VA

McLean, VA

Today

Full time Ai Security Cybersecurity Operations Cybersecurity Operations Lead

Apply Now

Job Description

MANTECH is hiring a Cybersecurity Operations Specialist in McLean, VA to support cybersecurity incident response as a primary technical expert and operations lead. This onsite role blends deep incident investigation with security workflow engineering, along with management oversight, operational reporting, and contract compliance across enterprise and cloud environments.

Role Focus

You will serve as the tier-3 escalation point for complex, high-impact, multi-vector threats, driving investigations end-to-end and shaping how analysts and tooling respond to emerging risk. The position also emphasizes automation and operational readiness, including exercises, threat hunting, and maintaining technical toolsets and failover procedures for alternate-site operations.

Responsibilities

Lead end-to-end incident investigations across cloud and enterprise architectures as the tier-3 escalation lead for complex, high-impact, multi-vector security threats.
Architect automated playbooks, integrate threat intelligence, and leverage AI capabilities within SIEM/EDR tools to improve detection and streamline analyst workflows.
Design and execute exercises, perform threat hunting, and maintain technical toolsets and failover procedures for alternate-site operations.
Manage shift personnel, conduct performance evaluations and 1-on-1 coaching, oversee onboarding, and maintain rosters to ensure continuous operational coverage.
Provision and audit role-based access control (RBAC), enforce documentation standards, and manage emergency continuity and relocation protocols.
Own operational KPIs, deliver executive reporting on threat trends and program health, and align workflows with contract and government leadership.

Requirements

High School Diploma
10+ years of cybersecurity experience
5+ years in cyber defense operations, incident response, or CSOC environments
3+ years managing or leading technical staff, including oversight of schedules and administrative deliverables
Experience leading complex incident response investigations across multi-cloud and enterprise architectures
5+ years supporting large, classified cybersecurity contracts within the IC
GIAC GCIH, GCFA, GNFA, CCSP, or CISSP certification(s)
Project Management Professional (PMP) or ITIL certification(s)
Active/current TS/SCI with Polygraph is required
Must be able to remain in a stationary position 50% of the time

Technologies

SIEM/EDR
RBAC
AI

View full job page →

Today

Cybersecurity Incident Response Analyst

MANTECH McLean, VA

McLean, VA

Today

Full time Cybersecurity Operations Incident Management Incident Response

Apply Now

Job Description

MANTECH is hiring a Cybersecurity Incident Response Analyst in McLean, VA to support mission-essential infrastructure with 24x7x365 coverage. In this onsite role, you will help ensure timely detection, investigation, and response while working within DoD-related clearance and certification requirements.

Why this role

24x7x365 operational impact supporting mission-critical environments
Shift-based schedules on a fixed 4-day work week with 10-hour shifts
Training support with six weeks of initial day-shift training for new team members
Growth path tied to compliance, including the requirement to obtain DoD 8570 IAT-II certification within 6 months of hire

Responsibilities

Conduct incident detection and monitoring to support continuous coverage
Perform incident analysis and investigation to understand scope and impact
Support incident response and mitigation activities throughout the lifecycle
Provide threat intelligence and support vulnerability management activities
Complete reporting and documentation for security events and outcomes

Requirements

High school diploma and 1+ years of experience in a cyber related role
1+ years of experience with cyber incident response
Knowledge of cybersecurity principles and incident detection, analysis, and response methodologies
Knowledge of operating systems, network protocols, and security
Knowledge of threat intelligence, vulnerability management, and security incident response best practices
Ability to obtain DoD 8570 IAT-II certification within 6 months of hire
Must have current/active TS/SCI with Polygraph
Ability to remain in a stationary position 50% of the time

Work schedule / shifts

Fixed 4-day work week consisting of 10-hour shifts
Available schedules assigned to either Sunday through Wednesday or Wednesday through Saturday
Openings across:
- 1st shift (6am to 4pm)
- 2nd shift (12pm to 10pm)
- 3rd shift (9pm to 7am)
Shift differentials apply to 2nd and 3rd shifts
All new team members must complete initial training on the day shift for six weeks

Preferred qualifications

Bachelor’s degree in a technical field

View full job page →

Today

Senior Director - Cybersecurity Identity & Access Management

MCKESSON Richmond, VA

Richmond, VA

Today

$175k - $291k/yr Full time Senior Cloud Identity And Access Cloud Identity And Access Management

Apply Now

Job Description

Lead enterprise identity strategy as a core cybersecurity executive driving a unified Identity & Access Management vision. This onsite role in Richmond, VA reports to the CISO and combines executive ownership with hands-on architectural and operational excellence across SSO, MFA, governance, PAM, CIAM, and identity threat detection.

The Senior Director partners with technology, application, risk, and compliance leaders to embed zero-trust controls, strengthen regulatory alignment, and improve identity risk reporting and remediation outcomes. You will also guide multi-year transformation through automation and advanced analytics to increase scalability, reliability, and measurable security performance.

Responsibilities

Establish, own, and execute the overarching Identity & Access Management vision, multi-year strategy, roadmap, and operating model, including hiring and managing the IAM organization
Implement and oversee core IAM capabilities: SSO, MFA, credential vaulting, identity governance, privileged access management, secrets management, lifecycle management, access certifications, identity-related threat detection, third-party governance, and CIAM
Design identity solutions for complex or non-standard deployment scenarios where standard IAM services cannot be directly applied
Own identity management governance by defining and meeting performance metrics, partnering with business teams to remediate non-compliance issues
Develop cyber security metrics and executive reporting processes, including KPIs and measurement routines
Partner with technology and application teams to onboard applications to enterprise-approved identity products and services during enterprise cloud migration
Coordinate with risk management and compliance stakeholders to maintain full regulatory alignment
Set non-human identity (NHI) governance and secrets management controls, including machine identity lifecycle management, service account rotation, and API credential security across multi-cloud environments
Partner with Threat Detection and Response leadership to implement identity threat detection and response (ITDR) for continuous monitoring, detection, and remediation of anomalous access behaviors and credential misuse
Drive cross-functional access governance across business, HR, and technology teams to enforce least privilege, RBAC, and automated joiner-mover-leaver workflows
Architect resilient cloud and federated identity models across multi-cloud and hybrid infrastructures, standardizing SSO, MFA, and zero-trust conditional access policies (Azure/Entra ID, GCP, Okta)
Lead M&A identity integration and divestiture strategies, including identity carve-outs, directory consolidations, and federation separation
Architect and deliver enterprise-grade identity products and services designed for scalability, fault tolerance, and high availability
Use automation, AI, and ML to improve operational efficiency, automate lifecycle governance and user provisioning, and enhance proactive identity threat detection

Requirements

Degree or equivalent experience. Typically requires 15+ years of professional experience and 10+ years of diversified leadership, planning, communication, organization, and people motivation skills (or equivalent experience)
15+ years of cybersecurity experience with significant depth in identity and access management, engineering and architecture, risk management, and compliance, including 10+ years leading teams and/or enterprise programs
Hands-on and leadership experience building and managing an IAM program
Proven ability to drive remediation at scale: establish SLAs, clarify ownership, prioritize backlogs, and close systemic gaps identified via incidents, hunts, and assessments
Executive-ready communication and stakeholder management to present risk, progress, and investment needs to senior leadership and influence decisions
Ability to set strategy, secure organizational alignment/approvals, and deliver outcomes across multiple stakeholders including Security, Infrastructure, Cloud, Application/Product, and business teams
Strong risk communication skills, including translating detection gaps and remediation tradeoffs into business impact and driving decisions to closure
Experience establishing oversight metrics and operational rhythms (OKRs/KPIs, reporting, service reviews) to improve alert quality, reduce noise, and accelerate remediation throughput
Working knowledge of relevant governance and regulatory expectations, with the ability to partner with audit/compliance and privacy stakeholders while operating effective detection and response capabilities
Track record of building high-performing teams and leading with integrity, accountability, and operational discipline
Experience developing multi-year roadmaps and influencing investment decisions related to people, tooling, telemetry, and automation
Experience managing vendor relationships and security tooling or managed services, including defining requirements and measuring performance against outcomes
Strong understanding of privacy considerations and monitoring practices; ability to partner with Legal/Privacy and HR while staying within policy and regulatory boundaries
Experience in hybrid/cloud environments and partnering with platform teams to instrument systems for reliable detections (cloud logging, identity signals, endpoint telemetry, network data)
Strong strategic and tactical decision-making to balance speed and risk, define compensating controls, and drive complex remediation decisions across multiple owners
Experience leading or sponsoring purple team activities, tabletop exercises, and control validation to improve detection coverage and response playbooks
Trusted leadership style that builds credibility with executives and teams through transparency, follow-through, and operational excellence

Education

Bachelor's degree in computer science, information security/assurance, engineering, or a related field; advanced degree preferred or equivalent experience

Certifications

Relevant certifications (preferred): CISSP, CISM, GIAC/SANS, +, SSCP, or equivalent foundational security certification
TDR/SecOps certifications (a plus): Google Cloud Professional Cloud Security Engineer and/or Associate Cloud Engineer, Google Professional Cloud DevOps Engineer, and/or GIAC certifications (for example, GSEC, GCIH), or cloud/security engineering certifications aligned to team platforms

Benefits

Medical, Dental, and Vision
Health Spending Accounts
Flexible Spending Accounts
401(k) (U.S.)
Pension (Canada)
Employee Stock Purchase Plan
Mental Health Programs
Flexible Schedules
Paid Time Off
Wellness Program
Education Reimbursement
Volunteer Opportunities
Flexible Work Environment

View full job page →

Today

Director, Service Infrastructure & Cybersecurity

Fluence Energy Arlington, VA

Arlington, VA

Today

Full time Cloud Cloud Architecture Cloud Infrastructure

Apply Now

Job Description

Fluence Energy is hiring an experienced leader to govern global service infrastructure and cybersecurity capabilities, with direct ownership of platform operations and the information security ecosystem. This onsite role in Arlington, VA supports high-availability enterprise cloud assets, central data platform infrastructure, and customer-facing edge environments.

As the primary engineering and escalation authority for the Remote Monitoring and Diagnostic Center (RMDC / Tier 1), this role focuses on scalable growth, security, resilience, and dependable operations across Tier 2 infrastructure.

What You’ll Own

Oversee global AWS resource administration, including EC2 OS lifecycle updates, EBS snapshots, AMI management, S3 lifecycle policies, resource cleanup, and capacity or quota monitoring.
Direct network architecture and operations, including global firewalls, Zero Trust Architecture (ZTA), VPC routing, and secure VPN connectivity to customer sites and jump hosts.
Administer Central Data Acquisition Systems (DAS - OS6 & OS7) and associated database infrastructure, driving MySQL/NoSQL automation, performance tuning, shard rollover, patching, and data purge policies.
Oversee platform lifecycle management across Linux OS, F.OS, firmware, controllers, servers, UPS devices, switches, routers, and firewalls.
Champion IAM governance across AWS and connected platforms by enforcing MFA, role-based policies, least privilege, key rotations, and recurring joiner/mover/leaver access reviews.
Manage cybersecurity operations including vulnerability scanning, security group and firewall rule reviews, patch compliance execution, coordination of penetration testing, and secrets or vault administration.
Lead standardized global rollouts for OS, platform, and firmware updates across cloud, Central DAS, and edge environments in coordination with Field Service Engineers.
Manage site onboarding deployments, site decommissioning workflows, deployment runbooks, rollback protocols, and test or staging validation prior to production releases.
Advance software automation and internal tooling initiatives by promoting Infrastructure-as-Code (IaC) and operational scripting to streamline recurring work.
Own change enablement processes, including change planning, maintenance window scheduling, risk reviews, rollback planning, and customer notification protocols.
Maintain global CMDB/site inventory (versions, configurations, IPs, contacts) and oversee hardware end-of-life and end-of-support tracking, spare allocation, and software license tracking or reclamation.
Define availability standards and DR plans (RTO/RPO targets) for Central DAS and customer-facing platforms, and lead scheduled DR failover drills and backup restore verifications.
Drive capacity forecasting for compute, storage, and licensing as sites scale, and support RMDC operations by directing Tier 2 monitoring architecture, threshold definitions, alert routing, and alert-fatigue cleanup.
Act as the Tier 2 escalation lead for root-cause analysis (RCA) on RMDC-escalated problems, maintaining standard runbooks, topology diagrams, vendor support contracts (AWS, Mango/Radix, OS licensing), and InfoSec audit evidence.

Required Qualifications

Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a closely related technical discipline.
10–12 years of progressively responsible experience in IT infrastructure, cloud platform operations, cybersecurity, or related technical disciplines, including at least 5 years in technical leadership or management roles.
Relevant certifications such as CISSP, CISM, AWS Certified Solutions Architect, ITIL, or equivalent credentials (preferred).
Strong preference for experience in energy, utilities, renewable energy, battery energy storage systems (BESS), industrial automation, or other mission-critical infrastructure environments.
Strong preference for experience supporting ICS, SCADA, industrial IoT, or interconnected IT/OT environments, including cybersecurity considerations for distributed industrial assets.
Proven experience managing enterprise-scale cloud infrastructure, preferably AWS, network security, Linux-based platforms, and cybersecurity operations supporting geographically distributed, high-availability environments.
Working knowledge of recognized cybersecurity and compliance frameworks, including NIST, IEC 62443, ISO 27001, and applicable critical infrastructure security requirements.
Demonstrated experience leading multidisciplinary technical teams, managing third-party service providers, and driving ITIL-aligned service operations, incident response, disaster recovery, and continuous improvement.

Core Technologies

AWS, EC2, EBS, AMI, S3
MySQL, NoSQL
Zero Trust Architecture (ZTA), VPC, VPN
Linux
Infrastructure-as-Code (IaC)
CMDB/site inventory, MFA
NIST, IEC 62443, ISO 27001, ITIL
CISSP, CISM, AWS Certified Solutions Architect
Mango/Radix, UPS

Work Authorization

Must be legally authorized to work in the United States at the time of application and throughout employment, without employer sponsorship.
Fluence does not sponsor work visas for this position.

View full job page →

Today

Systems Security Engineer

Bowhead Dahlgren, VA

Dahlgren, VA

Today

$110k - $135k/yr Full time Engineer Information Security InfoSec

Apply Now

Job Description

Bowhead is seeking a Systems Security Engineer (Cybersecurity/Quarantine Release) to support security engineering efforts from an onsite location in Dahlgren, VA. The role focuses on finding and reducing vulnerabilities across systems, networks, and operating environments, with an emphasis on assessments, hardening, and risk-driven remediation.

Working with DoD-aligned tooling and security principles, you will help translate vulnerability and configuration data into practical insights for improving an organization’s risk management posture, including impact and risk assessments and troubleshooting of cyber defense infrastructure anomalies.

Responsibilities

Perform vulnerability scans and recognize vulnerabilities in security systems.
Use DoD network analysis tools to identify vulnerabilities (for example, ACAS and HBSS).
Conduct application vulnerability assessments.
Identify systemic security issues by analyzing vulnerability and configuration data.
Share meaningful insights that reflect the context of an organization’s threat environment to strengthen its risk management posture.
Apply cybersecurity and privacy principles to organizational requirements, including confidentiality, integrity, availability, authentication, and non-repudiation.
Troubleshoot and diagnose anomalies in cyber defense infrastructure and work through resolution.
Complete impact/risk assessments.
Apply host and network access controls (such as an access control list).
Support network protection against malware using approaches such as NIPS, anti-malware, restricting or preventing external devices, and spam filters.
Complete other duties as assigned.

Requirements

High School Diploma required; a bachelor’s degree is highly desired.
3 to 5 years of relevant experience required.
Knowledge of computer networking concepts and protocols, along with network security methodologies.
Knowledge of network security architecture concepts, including topology, protocols, components, and principles such as defense-in-depth and zero trust.
Knowledge of basic system, network, and OS hardening techniques.
Knowledge of Intrusion Detection System (IDS) and Intrusion Prevention System (IPS) tools and applications.
Knowledge of network protocols including TCP/IP, Dynamic Host Configuration, DNS, and directory services.
Knowledge of application vulnerabilities.
Knowledge of system administration and hardening techniques for networks and operating systems.
Knowledge of operating system concepts across environments such as Unix/Linux, IOS, Android, and Windows.
Must meet DoD 8570 Information Assurance Technical Level II certification requirements at the time of hire.
Must currently hold a Top Secret security clearance.
US Citizenship is required for Top Secret clearance at this location.

Technologies

ACAS, HBSS, NIPS, anti-malware
Intrusion Detection System (IDS), Intrusion Prevention System (IPS) tools and applications
DoD network analysis tools
TCP/IP, Dynamic Host Configuration, DNS
Unix/Linux, IOS, Android, Windows
Virtual Private Network (VPN), encryption
Access control list
DoD 8570 Information Assurance Technical Level II certification requirements

Preferred Skills

Knowledge of cyber threats and vulnerabilities.
Knowledge of the operational impacts of cybersecurity lapses.
Knowledge of host/network access control mechanisms (for example, access control list and capabilities list).
Knowledge of cybersecurity and privacy principles tied to organizational requirements such as confidentiality, integrity, availability, authentication, and non-repudiation.
Knowledge of network traffic analysis methods.
Knowledge of VPN security.
Knowledge of transmission records and jamming techniques that enable undesirable information transmission or prevent installed systems from operating correctly (including Bluetooth, RFID, Infrared Networking, Wi-Fi, paging, cellular, satellite dishes, and VoIP).
Knowledge of network access, identity, and access management (including public key infrastructure, OAuth, OpenID, SAML, SPML).
Knowledge of system and application security threats and vulnerabilities such as buffer overflow, mobile code, cross-site scripting, PL/SQL and injection attacks, race conditions, covert channel, replay, return-oriented attacks, and malicious code.
Knowledge of classes of attacks including passive, active, insider, close-in, and distribution attacks.
Knowledge of application security risks.

Physical Demands

Must be able to lift up to 10-20 pounds or more.
Must be able to stand and walk for prolonged amounts of time.
Must be able to twist, bend, and squat periodically.

Location: Dahlgren, VA (onsite). Salary: USD 110,000 - 135,000 per year. Minimum experience: 3 years.

View full job page →

Today

Application Security Engineer – Software Vulnerability Remediation

CONCEPT SOLUTIONS LLC Reston, VA

Reston, VA

Today

$130k - $150k/yr Full time Application Security Code Level Security Dependency Vulnerabilities

Apply Now

Job Description

CONCEPT SOLUTIONS LLC is supporting a mission-critical application modernization program for a Department of War customer, and this Application Security Engineer role focuses on software vulnerability remediation in production environments. You will help locate security issues across an application portfolio, drive fixes in partnership with development teams, and keep security documentation aligned to continuous monitoring needs.

What you’ll do

Identify and remediate security findings across existing production applications, including dependency vulnerabilities, container vulnerabilities, STIG compliance issues, and code-level findings from security scans and assessments.
Maintain accurate and current Plans of Action and Milestones (POA&Ms) for the application portfolio, tracking security findings and remediation progress.
Collaborate with the Information System Security Engineer (ISSE) to develop and maintain application security evidence for continuous monitoring requirements.
Work with software development squads to implement secure coding fixes and address vulnerabilities in application codebases.
Support ongoing application security improvements while ensuring continued operation and sustainment of production applications.

What you bring

4+ years of experience in application security, secure software engineering, or a closely related discipline.
Hands-on experience identifying and remediating security vulnerabilities in Java or Go (Golang) applications.
Experience addressing security findings within production software environments.

Tools and technologies

Java
Go (Golang)
Syft
Grype

Security and compliance focus

Maintain or support application security evidence aligned to continuous monitoring.
Support and address STIG compliance issues as part of remediation work.

Nice to have

Experience using software vulnerability scanning tools such as Syft, Grype, or similar technologies.
Familiarity with Security Technical Implementation Guides (STIGs).
Active Secret security clearance.

Location, schedule, and logistics

Location: Hybrid. Reston, VA headquarters and approved remote locations within the United States, with on-site work at Government facilities in Northern Virginia and Maryland as required.
Equipment: Government-furnished equipment is used for access to Government environments.
Schedule: Full-time, 40 hours per week, Monday through Friday, with core hours of 9:00 a.m. to 3:00 p.m. Eastern.
Delivery cadence: Work is organized into two-week sprints, with a customer demonstration each sprint.
Travel: 0–10% within the Washington, DC metropolitan area.

Clearance and eligibility

U.S. citizenship required. Must be eligible to obtain and maintain a DoW security clearance.
An active Secret clearance or higher is strongly preferred and may allow an earlier start.

Compensation and benefits

Base salary: $130,000–$150,000 annually, depending on experience.
Health insurance: Health, dental, and vision insurance.
Life insurance: Life insurance.
Retirement: Comprehensive 401(k) plan with matching and immediate vesting.

This position is contingent upon contract award, with an anticipated start in October 2026.

View full job page →

Today

Mid Cybersecurity Incident Analyst

Everforth ECS Arlington, VA

Arlington, VA

Today

$140k - $160k/yr Full time Cyber Threat Analysis Cybersecurity Analysis Cybersecurity Tools

Apply Now

Job Description

Everforth ECS is seeking a Mid Cybersecurity Incident Analyst for a hybrid, contract-award contingent role supporting CISA’s TESS program and directly supporting JCDC Operations. The position focuses on deep technical incident analysis across IT, OT/ICS, cloud, and AI environments, with an emphasis on practical guidance for vulnerability mitigation and detection.

Responsibilities

Conduct analysis of active cyber incidents, events, and vulnerabilities to provide guidance and targeted mitigation recommendations.
Assist in producing written guidance and recommendations to support JCDC partners in addressing active and ongoing cyber vulnerabilities.
Monitor emerging technologies and cybersecurity trends, applying that knowledge to improve threat detection and mitigation efforts.
Perform hands-on technical analysis to identify insights into vulnerabilities, adversarial tactics, and mitigation strategies across diverse environments including IT, OT/ICS, cloud, and AI systems.
Support mapping of technical threat insights to frameworks such as MITRE ATT&CK and other cyber frameworks.
Help translate strategic products into clear, practical formats aligned to stakeholder needs and operational constraints, including large and small jurisdictions and critical infrastructure (CI) partners.
Tailor vulnerability mitigation recommendations and provide contextualized examples that address implementation challenges and support rapid adoption.

Requirements

Active Top Secret Clearance.
US citizenship, with the ability to obtain and maintain a minimum of DHS (Suitability) EOD/ Public Trust.
6+ years of experience in threat intelligence, cyber security, incident response, or a closely related role.
Strong understanding of computer and network fundamentals.
Basic understanding of computer architecture, operating systems, vulnerabilities, encryption, or related areas of expertise.
Experience defining data sources and writing detection rules to identify malicious behavior.
Ability to perform in-depth research tasks with minimal support and produce written summaries that include insights and predictions based on analytical processes.
Excellent written and oral communication skills.
Knowledge of current cyber threats and exploits, including attack methodology and detection techniques using a broad range of security products, including COTS and open source.