Genesis10 is currently seeking a Senior Cyber Security Analyst - Remote position with a Global Financial Institution located in New York, NY. This is a 4 month contract opportunity. As a Senior Cyber Security Analyst, you will be a key part of a high-performing Security Operations Center (SOC) team, dedicated to continually improving and advancing capabilities to protect our client. You will leverage a passion for Cybersecurity to ensure monitoring and response capabilities are effective and efficient, keeping pace with a rapidly changing threat landscape. This role involves supporting the monitoring and response of cyber security alerts and incidents by investigating them to find the root cause and identifying gaps in controls. Responsibilities: Act as a core member of the SOC including Cyber Monitoring & Response/Purple Teaming/Threat Hunting/Digital Forensics/Incident Response Analyze security alerts and respond to security events and incidents Maintain and update monitoring & response playbooks Conduct proactive threat hunting Develop expertise in our monitoring systems and technology to act as an SME in working with our detection engineering and automation teams to enhance our abilities to prevent, detect & respond Test new adversary TTPs and our ability to detect and respond to them Identify opportunities for efficiency, work hand in hand with Security Automation team to automate and improve our response processes Assist in the implementation and ongoing support of security systems Execute tasks or support projects to enhance team's capabilities Follow standards for security excellence within the SOC Requirements: 4 years of experience in cyber security, ideally in a SOC, DFIR, or CSIRT role Comprehensive understanding of cyber security best practices, risk vectors, mitigation techniques and protection software Knowledge of network security concepts and tools such as firewalls, proxy servers, email security and suspicious traffic flows Analytical ability in incident response Ability to convey cyber security policies and concepts to employees and understand security best practices Strong understanding of MITRE ATT&CK, Cyber Kill Chain and similar frameworks Strong knowledge of security controls related to the detection, analysis, and response (SIEM, EDR, NDR, XDR, UEBA) Strong knowledge of Windows and Linux systems, Active Directory, and Cloud technologies Strong verbal and written communication skills with experience in documenting work to a high level Must be self-directed with the ability to work independently Ability to multi-task and remain productive in a service-driven and results-oriented environment Demonstrated strong organizational, analytical, and problem-solving skills Desired skills: Professional Certifications such as GCIH, GNFA, GFCA, Certified Ethical Hacker (CEH), OSCP, CISSP or similar Pay range up to: $60.23 per hour Only candidates available and ready to work directly as Genesis10 employees will be considered for this position. If you have the described qualifications and are interested in this exciting opportunity, please apply! Ranked a Top Staffing Firm in the U.S. by Staffing Industry Analysts for six consecutive years, Genesis10 puts thousands of consultants and employees to work across the United States every year in contract, contract-for-hire, and permanent placement roles. With more than 300 active clients, Genesis10 provides access to many of the Fortune 100 firms and a variety of mid-market organizations across the full spectrum of industry verticals. For contract roles, Genesis10 offers the benefits listed below. If this is a perm-placement opportunity, our recruiter can talk you through the unique benefits offered for that particular client. Benefits of Working with Genesis10: Access to hundreds of clients, most who have been working with Genesis10 for 5-20 years. The opportunity to have a career-home in Genesis10; many of our consultants have been working exclusively with Genesis10 for years. Access to an experienced, caring recruiting team (more than 7 years of experience, on average.) Behavioral Health Platform Medical, Dental, Vision Health Savings Account Voluntary Hospital Indemnity (Critical Illness & Accident) Voluntary Term Life Insurance 401K Sick Pay (for applicable states/municipalities) Commuter Benefits (Dallas, NYC, SF, and Illinois) For multiple years running, Genesis10 has been recognized as a Top Staffing Firm in the U.S., as a Best Company for Work-Life Balance, as a Best Company for Career Growth, for Diversity, and for Leadership, amongst others. To learn more and to view all our available career opportunities, please visit us at our website. Genesis10 is an Equal Opportunity Employer. Candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.
11/09/2026
Full time
Genesis10 is currently seeking a Senior Cyber Security Analyst - Remote position with a Global Financial Institution located in New York, NY. This is a 4 month contract opportunity. As a Senior Cyber Security Analyst, you will be a key part of a high-performing Security Operations Center (SOC) team, dedicated to continually improving and advancing capabilities to protect our client. You will leverage a passion for Cybersecurity to ensure monitoring and response capabilities are effective and efficient, keeping pace with a rapidly changing threat landscape. This role involves supporting the monitoring and response of cyber security alerts and incidents by investigating them to find the root cause and identifying gaps in controls. Responsibilities: Act as a core member of the SOC including Cyber Monitoring & Response/Purple Teaming/Threat Hunting/Digital Forensics/Incident Response Analyze security alerts and respond to security events and incidents Maintain and update monitoring & response playbooks Conduct proactive threat hunting Develop expertise in our monitoring systems and technology to act as an SME in working with our detection engineering and automation teams to enhance our abilities to prevent, detect & respond Test new adversary TTPs and our ability to detect and respond to them Identify opportunities for efficiency, work hand in hand with Security Automation team to automate and improve our response processes Assist in the implementation and ongoing support of security systems Execute tasks or support projects to enhance team's capabilities Follow standards for security excellence within the SOC Requirements: 4 years of experience in cyber security, ideally in a SOC, DFIR, or CSIRT role Comprehensive understanding of cyber security best practices, risk vectors, mitigation techniques and protection software Knowledge of network security concepts and tools such as firewalls, proxy servers, email security and suspicious traffic flows Analytical ability in incident response Ability to convey cyber security policies and concepts to employees and understand security best practices Strong understanding of MITRE ATT&CK, Cyber Kill Chain and similar frameworks Strong knowledge of security controls related to the detection, analysis, and response (SIEM, EDR, NDR, XDR, UEBA) Strong knowledge of Windows and Linux systems, Active Directory, and Cloud technologies Strong verbal and written communication skills with experience in documenting work to a high level Must be self-directed with the ability to work independently Ability to multi-task and remain productive in a service-driven and results-oriented environment Demonstrated strong organizational, analytical, and problem-solving skills Desired skills: Professional Certifications such as GCIH, GNFA, GFCA, Certified Ethical Hacker (CEH), OSCP, CISSP or similar Pay range up to: $60.23 per hour Only candidates available and ready to work directly as Genesis10 employees will be considered for this position. If you have the described qualifications and are interested in this exciting opportunity, please apply! Ranked a Top Staffing Firm in the U.S. by Staffing Industry Analysts for six consecutive years, Genesis10 puts thousands of consultants and employees to work across the United States every year in contract, contract-for-hire, and permanent placement roles. With more than 300 active clients, Genesis10 provides access to many of the Fortune 100 firms and a variety of mid-market organizations across the full spectrum of industry verticals. For contract roles, Genesis10 offers the benefits listed below. If this is a perm-placement opportunity, our recruiter can talk you through the unique benefits offered for that particular client. Benefits of Working with Genesis10: Access to hundreds of clients, most who have been working with Genesis10 for 5-20 years. The opportunity to have a career-home in Genesis10; many of our consultants have been working exclusively with Genesis10 for years. Access to an experienced, caring recruiting team (more than 7 years of experience, on average.) Behavioral Health Platform Medical, Dental, Vision Health Savings Account Voluntary Hospital Indemnity (Critical Illness & Accident) Voluntary Term Life Insurance 401K Sick Pay (for applicable states/municipalities) Commuter Benefits (Dallas, NYC, SF, and Illinois) For multiple years running, Genesis10 has been recognized as a Top Staffing Firm in the U.S., as a Best Company for Work-Life Balance, as a Best Company for Career Growth, for Diversity, and for Leadership, amongst others. To learn more and to view all our available career opportunities, please visit us at our website. Genesis10 is an Equal Opportunity Employer. Candidates will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.
You're already the person your team turns to when the toughest issues land. Now it's time to lead the desk, develop the team, and help fix what keeps breaking. Weidenhammer is looking for an IT Operations Technical Lead to lead our Cloud & Infrastructure Service Desk while staying hands-on as the senior escalation point across Microsoft 365, Azure, Entra ID, Windows Server, virtualization, networking, backup and disaster recovery, and security. You'll coach and develop service desk analysts and engineers, lead the response when major incidents occur, and drive problem management to eliminate recurring issues at the root. Just as importantly, you'll help shape how we use smarter monitoring, automation, and AI-assisted tools to continually improve the way we deliver managed services to our clients. Have ideas for making operations better? Good. We want them. This is an opportunity to do more than resolve the next ticket. You'll have the ability to improve processes, strengthen the team, and help build a more proactive and efficient service environment. Why Weidenhammer? For nearly 50 years, Weidenhammer has helped middle-market organizations modernize technology, strengthen cybersecurity, and put data and AI to work. We're a senior-led, outcome-driven Microsoft partner with 100+ professionals delivering managed services, cloud, and hosting solutions from our data center footprint in Collegeville, PA, backed by a disaster recovery site in Chandler, AZ. Our technical leads get real responsibility, broad technology exposure, and the opportunity to make an impact. We believe in solving problems the right way, investing in better tools and automation, and creating an environment where people learn from one another and grow. Some of our best professionals started on the service desk and continued building their careers from there. We also offer a competitive benefits package that includes medical, dental, and vision insurance, a 401(k), paid time off, paid parental leave, training and development opportunities, paid volunteer time, wellness programs, and hybrid flexibility. Ready to stop just solving the toughest problems and start leading the way forward? The IT Operations Technical Manager leads the Cloud and Infrastructure Service Desk and serves as the senior hands-on technical escalation point for the operations team supporting Weidenhammer clients. The role combines advanced troubleshooting, technical mentoring, platform administration, documentation, and service improvement across client infrastructure, cloud, identity, endpoint, network, backup, monitoring, and security technologies. Working closely with the Cloud and Infrastructure team, the Manager may be assigned to do complete any of the following: support, mentor, and manage service desk team members, diagnose complex problems, coordinate technical responses during high-impact incidents, validate changes, strengthen monitoring and automation, and ensure new solutions are secure, supportable, and well documented before they enter ongoing support. Essential Functions Manage the Cloud and Infrastructure Service Desk and serve as the senior technical escalation resource for complex incidents and service requests across Microsoft 365, Azure, Windows Server, virtualization, networking, identity, endpoint management, backup, recovery, monitoring, and security operations. Lead structured troubleshooting and root-cause analysis, using logs, telemetry, configuration data, monitoring platforms, and vendor resources to isolate issues and restore service. Provide hands-on technical guidance and coaching to Service Desk Analysts, System Administrators, and Engineers; review troubleshooting approaches, recommend next steps, and strengthen team capability. Coordinate the technical response during major incidents, including triage, workstream assignment, vendor escalation, recovery validation, technical updates, and post-incident corrective actions. Administer, configure, and improve the platforms used to monitor, manage, secure, document, and support client environments within approved access and change-control practices. Develop and maintain technical standards, configuration baselines, build documentation, runbooks, knowledge articles, diagrams, and escalation procedures, along with accurate configuration, asset, licensing, and subscription records in approved service-management and documentation platforms. Review monitoring coverage, alert quality, thresholds, and response procedures to reduce noise and improve early detection of client-impacting conditions. Lead problem management for recurring or high-impact issues, analyzing incident trends, alert patterns, capacity concerns, and platform health data, and implement durable corrective actions (standardized configurations, automation, tool consolidation, documentation, or architectural recommendations) prioritized by risk and client impact. Perform and validate complex changes, maintenance activities, upgrades, migrations, and remediation work, including risk assessment, testing, communication, and rollback planning. Partner with security teams to operationalize identity protection, endpoint security, patching, vulnerability remediation, privileged-access controls, backup and recovery, certificate and lifecycle management, logging, incident response, and evidence requirements across managed environments. Use scripting, workflow automation, APIs, and AI-assisted tools to improve troubleshooting, reporting, configuration consistency, documentation, and repetitive operational work, with appropriate review and governance. Participate in solution reviews and project handoffs and provide technical oversight for transitioning new and changed services into support, identifying supportability concerns, technical debt, and security risks, and validating documentation, monitoring, access, security controls, backup, support ownership, and operational readiness before acceptance. Explain technical conditions, business impact, risks, and recommend next steps in clear language to clients and internal stakeholders, and coordinate with technology vendors and partners, carriers, and third-party support organizations to resolve product defects, service issues, licensing concerns, and complex escalations. Maintain deep working knowledge of the managed-services technology portfolio and pursue role-aligned learning and certifications that support client and service needs. Contribute technical input to client onboarding, assessments, service reviews, proposals, and scope validation when operational expertise is required. Assist with after-hours maintenance and participate in the technical escalation rotation for critical client issues as required. Promote disciplined use of incident, request, problem, change, configuration, knowledge, and continual-improvement practices across the team. Competencies Practical knowledge of IT service management, including incident, major incident, problem, change, request, configuration, knowledge, and continual-improvement practices and the technical evidence required to support them. Advanced hands-on troubleshooting experience across Microsoft 365, Azure, Windows Server, Active Directory and Entra ID, virtualization, networking, endpoint management, backup and recovery, monitoring, and security technologies, including diagnosing complex, multi-layer issues using logs, packet and performance data, telemetry, and configuration analysis. Experience administering remote monitoring and management, IT service-management, documentation, endpoint, identity, backup, security, and observability platforms in an MSP or multi-client environment. Working knowledge of PowerShell or comparable scripting, workflow automation, APIs, and AI-assisted technical tools, with appropriate testing, security, and human review. Strong understanding of identity, least privilege, endpoint protection, vulnerability remediation, logging, backup, recovery, network security, and secure configuration principles. Ability to translate technical findings into clear business impact, risk, recovery options, and recommendations for clients and leadership. Demonstrated judgment during major incidents, production changes, competing priorities, and high-pressure client escalations. Strong technical writing skills, including runbooks, diagrams, build standards, knowledge articles, and post-incident documentation. Ability to lead, mentor, and develop technical professionals, coordinate work across teams, and raise technical quality. Highly organized, self-directed, and accountable, with disciplined change control, validation, and follow-through. Project awareness sufficient to manage technical dependencies, risks, testing, cutover activities, operational acceptance, and stakeholder communication. What Success Looks Like Team members have clear expectations, regular coaching, development plans, and appropriate coverage, and receive practical technical guidance that improves first-contact resolution, escalation quality, and confidence handling increasingly complex work. Recurring issues, manual effort, and avoidable client disruption are measurably reduced through problem management, root-cause analysis, permanent corrective actions, technical standards, automation, and knowledge reuse. Client environments have current monitoring, meaningful alerts, accurate documentation and runbooks, supportable configurations, and clearly defined escalation paths that are consistently followed. . click apply for full job details
11/09/2026
Full time
You're already the person your team turns to when the toughest issues land. Now it's time to lead the desk, develop the team, and help fix what keeps breaking. Weidenhammer is looking for an IT Operations Technical Lead to lead our Cloud & Infrastructure Service Desk while staying hands-on as the senior escalation point across Microsoft 365, Azure, Entra ID, Windows Server, virtualization, networking, backup and disaster recovery, and security. You'll coach and develop service desk analysts and engineers, lead the response when major incidents occur, and drive problem management to eliminate recurring issues at the root. Just as importantly, you'll help shape how we use smarter monitoring, automation, and AI-assisted tools to continually improve the way we deliver managed services to our clients. Have ideas for making operations better? Good. We want them. This is an opportunity to do more than resolve the next ticket. You'll have the ability to improve processes, strengthen the team, and help build a more proactive and efficient service environment. Why Weidenhammer? For nearly 50 years, Weidenhammer has helped middle-market organizations modernize technology, strengthen cybersecurity, and put data and AI to work. We're a senior-led, outcome-driven Microsoft partner with 100+ professionals delivering managed services, cloud, and hosting solutions from our data center footprint in Collegeville, PA, backed by a disaster recovery site in Chandler, AZ. Our technical leads get real responsibility, broad technology exposure, and the opportunity to make an impact. We believe in solving problems the right way, investing in better tools and automation, and creating an environment where people learn from one another and grow. Some of our best professionals started on the service desk and continued building their careers from there. We also offer a competitive benefits package that includes medical, dental, and vision insurance, a 401(k), paid time off, paid parental leave, training and development opportunities, paid volunteer time, wellness programs, and hybrid flexibility. Ready to stop just solving the toughest problems and start leading the way forward? The IT Operations Technical Manager leads the Cloud and Infrastructure Service Desk and serves as the senior hands-on technical escalation point for the operations team supporting Weidenhammer clients. The role combines advanced troubleshooting, technical mentoring, platform administration, documentation, and service improvement across client infrastructure, cloud, identity, endpoint, network, backup, monitoring, and security technologies. Working closely with the Cloud and Infrastructure team, the Manager may be assigned to do complete any of the following: support, mentor, and manage service desk team members, diagnose complex problems, coordinate technical responses during high-impact incidents, validate changes, strengthen monitoring and automation, and ensure new solutions are secure, supportable, and well documented before they enter ongoing support. Essential Functions Manage the Cloud and Infrastructure Service Desk and serve as the senior technical escalation resource for complex incidents and service requests across Microsoft 365, Azure, Windows Server, virtualization, networking, identity, endpoint management, backup, recovery, monitoring, and security operations. Lead structured troubleshooting and root-cause analysis, using logs, telemetry, configuration data, monitoring platforms, and vendor resources to isolate issues and restore service. Provide hands-on technical guidance and coaching to Service Desk Analysts, System Administrators, and Engineers; review troubleshooting approaches, recommend next steps, and strengthen team capability. Coordinate the technical response during major incidents, including triage, workstream assignment, vendor escalation, recovery validation, technical updates, and post-incident corrective actions. Administer, configure, and improve the platforms used to monitor, manage, secure, document, and support client environments within approved access and change-control practices. Develop and maintain technical standards, configuration baselines, build documentation, runbooks, knowledge articles, diagrams, and escalation procedures, along with accurate configuration, asset, licensing, and subscription records in approved service-management and documentation platforms. Review monitoring coverage, alert quality, thresholds, and response procedures to reduce noise and improve early detection of client-impacting conditions. Lead problem management for recurring or high-impact issues, analyzing incident trends, alert patterns, capacity concerns, and platform health data, and implement durable corrective actions (standardized configurations, automation, tool consolidation, documentation, or architectural recommendations) prioritized by risk and client impact. Perform and validate complex changes, maintenance activities, upgrades, migrations, and remediation work, including risk assessment, testing, communication, and rollback planning. Partner with security teams to operationalize identity protection, endpoint security, patching, vulnerability remediation, privileged-access controls, backup and recovery, certificate and lifecycle management, logging, incident response, and evidence requirements across managed environments. Use scripting, workflow automation, APIs, and AI-assisted tools to improve troubleshooting, reporting, configuration consistency, documentation, and repetitive operational work, with appropriate review and governance. Participate in solution reviews and project handoffs and provide technical oversight for transitioning new and changed services into support, identifying supportability concerns, technical debt, and security risks, and validating documentation, monitoring, access, security controls, backup, support ownership, and operational readiness before acceptance. Explain technical conditions, business impact, risks, and recommend next steps in clear language to clients and internal stakeholders, and coordinate with technology vendors and partners, carriers, and third-party support organizations to resolve product defects, service issues, licensing concerns, and complex escalations. Maintain deep working knowledge of the managed-services technology portfolio and pursue role-aligned learning and certifications that support client and service needs. Contribute technical input to client onboarding, assessments, service reviews, proposals, and scope validation when operational expertise is required. Assist with after-hours maintenance and participate in the technical escalation rotation for critical client issues as required. Promote disciplined use of incident, request, problem, change, configuration, knowledge, and continual-improvement practices across the team. Competencies Practical knowledge of IT service management, including incident, major incident, problem, change, request, configuration, knowledge, and continual-improvement practices and the technical evidence required to support them. Advanced hands-on troubleshooting experience across Microsoft 365, Azure, Windows Server, Active Directory and Entra ID, virtualization, networking, endpoint management, backup and recovery, monitoring, and security technologies, including diagnosing complex, multi-layer issues using logs, packet and performance data, telemetry, and configuration analysis. Experience administering remote monitoring and management, IT service-management, documentation, endpoint, identity, backup, security, and observability platforms in an MSP or multi-client environment. Working knowledge of PowerShell or comparable scripting, workflow automation, APIs, and AI-assisted technical tools, with appropriate testing, security, and human review. Strong understanding of identity, least privilege, endpoint protection, vulnerability remediation, logging, backup, recovery, network security, and secure configuration principles. Ability to translate technical findings into clear business impact, risk, recovery options, and recommendations for clients and leadership. Demonstrated judgment during major incidents, production changes, competing priorities, and high-pressure client escalations. Strong technical writing skills, including runbooks, diagrams, build standards, knowledge articles, and post-incident documentation. Ability to lead, mentor, and develop technical professionals, coordinate work across teams, and raise technical quality. Highly organized, self-directed, and accountable, with disciplined change control, validation, and follow-through. Project awareness sufficient to manage technical dependencies, risks, testing, cutover activities, operational acceptance, and stakeholder communication. What Success Looks Like Team members have clear expectations, regular coaching, development plans, and appropriate coverage, and receive practical technical guidance that improves first-contact resolution, escalation quality, and confidence handling increasingly complex work. Recurring issues, manual effort, and avoidable client disruption are measurably reduced through problem management, root-cause analysis, permanent corrective actions, technical standards, automation, and knowledge reuse. Client environments have current monitoring, meaningful alerts, accurate documentation and runbooks, supportable configurations, and clearly defined escalation paths that are consistently followed. . click apply for full job details
You're already the person your team turns to when the toughest issues land. Now it's time to lead the desk, develop the team, and help fix what keeps breaking. Weidenhammer is looking for an IT Operations Technical Lead to lead our Cloud & Infrastructure Service Desk while staying hands-on as the senior escalation point across Microsoft 365, Azure, Entra ID, Windows Server, virtualization, networking, backup and disaster recovery, and security. You'll coach and develop service desk analysts and engineers, lead the response when major incidents occur, and drive problem management to eliminate recurring issues at the root. Just as importantly, you'll help shape how we use smarter monitoring, automation, and AI-assisted tools to continually improve the way we deliver managed services to our clients. Have ideas for making operations better? Good. We want them. This is an opportunity to do more than resolve the next ticket. You'll have the ability to improve processes, strengthen the team, and help build a more proactive and efficient service environment. Why Weidenhammer? For nearly 50 years, Weidenhammer has helped middle-market organizations modernize technology, strengthen cybersecurity, and put data and AI to work. We're a senior-led, outcome-driven Microsoft partner with 100+ professionals delivering managed services, cloud, and hosting solutions from our data center footprint in Collegeville, PA, backed by a disaster recovery site in Chandler, AZ. Our technical leads get real responsibility, broad technology exposure, and the opportunity to make an impact. We believe in solving problems the right way, investing in better tools and automation, and creating an environment where people learn from one another and grow. Some of our best professionals started on the service desk and continued building their careers from there. We also offer a competitive benefits package that includes medical, dental, and vision insurance, a 401(k), paid time off, paid parental leave, training and development opportunities, paid volunteer time, wellness programs, and hybrid flexibility. Ready to stop just solving the toughest problems and start leading the way forward? The IT Operations Technical Manager leads the Cloud and Infrastructure Service Desk and serves as the senior hands-on technical escalation point for the operations team supporting Weidenhammer clients. The role combines advanced troubleshooting, technical mentoring, platform administration, documentation, and service improvement across client infrastructure, cloud, identity, endpoint, network, backup, monitoring, and security technologies. Working closely with the Cloud and Infrastructure team, the Manager may be assigned to do complete any of the following: support, mentor, and manage service desk team members, diagnose complex problems, coordinate technical responses during high-impact incidents, validate changes, strengthen monitoring and automation, and ensure new solutions are secure, supportable, and well documented before they enter ongoing support. Essential Functions Manage the Cloud and Infrastructure Service Desk and serve as the senior technical escalation resource for complex incidents and service requests across Microsoft 365, Azure, Windows Server, virtualization, networking, identity, endpoint management, backup, recovery, monitoring, and security operations. Lead structured troubleshooting and root-cause analysis, using logs, telemetry, configuration data, monitoring platforms, and vendor resources to isolate issues and restore service. Provide hands-on technical guidance and coaching to Service Desk Analysts, System Administrators, and Engineers; review troubleshooting approaches, recommend next steps, and strengthen team capability. Coordinate the technical response during major incidents, including triage, workstream assignment, vendor escalation, recovery validation, technical updates, and post-incident corrective actions. Administer, configure, and improve the platforms used to monitor, manage, secure, document, and support client environments within approved access and change-control practices. Develop and maintain technical standards, configuration baselines, build documentation, runbooks, knowledge articles, diagrams, and escalation procedures, along with accurate configuration, asset, licensing, and subscription records in approved service-management and documentation platforms. Review monitoring coverage, alert quality, thresholds, and response procedures to reduce noise and improve early detection of client-impacting conditions. Lead problem management for recurring or high-impact issues, analyzing incident trends, alert patterns, capacity concerns, and platform health data, and implement durable corrective actions (standardized configurations, automation, tool consolidation, documentation, or architectural recommendations) prioritized by risk and client impact. Perform and validate complex changes, maintenance activities, upgrades, migrations, and remediation work, including risk assessment, testing, communication, and rollback planning. Partner with security teams to operationalize identity protection, endpoint security, patching, vulnerability remediation, privileged-access controls, backup and recovery, certificate and lifecycle management, logging, incident response, and evidence requirements across managed environments. Use scripting, workflow automation, APIs, and AI-assisted tools to improve troubleshooting, reporting, configuration consistency, documentation, and repetitive operational work, with appropriate review and governance. Participate in solution reviews and project handoffs and provide technical oversight for transitioning new and changed services into support, identifying supportability concerns, technical debt, and security risks, and validating documentation, monitoring, access, security controls, backup, support ownership, and operational readiness before acceptance. Explain technical conditions, business impact, risks, and recommend next steps in clear language to clients and internal stakeholders, and coordinate with technology vendors and partners, carriers, and third-party support organizations to resolve product defects, service issues, licensing concerns, and complex escalations. Maintain deep working knowledge of the managed-services technology portfolio and pursue role-aligned learning and certifications that support client and service needs. Contribute technical input to client onboarding, assessments, service reviews, proposals, and scope validation when operational expertise is required. Assist with after-hours maintenance and participate in the technical escalation rotation for critical client issues as required. Promote disciplined use of incident, request, problem, change, configuration, knowledge, and continual-improvement practices across the team. Competencies Practical knowledge of IT service management, including incident, major incident, problem, change, request, configuration, knowledge, and continual-improvement practices and the technical evidence required to support them. Advanced hands-on troubleshooting experience across Microsoft 365, Azure, Windows Server, Active Directory and Entra ID, virtualization, networking, endpoint management, backup and recovery, monitoring, and security technologies, including diagnosing complex, multi-layer issues using logs, packet and performance data, telemetry, and configuration analysis. Experience administering remote monitoring and management, IT service-management, documentation, endpoint, identity, backup, security, and observability platforms in an MSP or multi-client environment. Working knowledge of PowerShell or comparable scripting, workflow automation, APIs, and AI-assisted technical tools, with appropriate testing, security, and human review. Strong understanding of identity, least privilege, endpoint protection, vulnerability remediation, logging, backup, recovery, network security, and secure configuration principles. Ability to translate technical findings into clear business impact, risk, recovery options, and recommendations for clients and leadership. Demonstrated judgment during major incidents, production changes, competing priorities, and high-pressure client escalations. Strong technical writing skills, including runbooks, diagrams, build standards, knowledge articles, and post-incident documentation. Ability to lead, mentor, and develop technical professionals, coordinate work across teams, and raise technical quality. Highly organized, self-directed, and accountable, with disciplined change control, validation, and follow-through. Project awareness sufficient to manage technical dependencies, risks, testing, cutover activities, operational acceptance, and stakeholder communication. What Success Looks Like Team members have clear expectations, regular coaching, development plans, and appropriate coverage, and receive practical technical guidance that improves first-contact resolution, escalation quality, and confidence handling increasingly complex work. Recurring issues, manual effort, and avoidable client disruption are measurably reduced through problem management, root-cause analysis, permanent corrective actions, technical standards, automation, and knowledge reuse. Client environments have current monitoring, meaningful alerts, accurate documentation and runbooks, supportable configurations, and clearly defined escalation paths that are consistently followed. . click apply for full job details
11/09/2026
Full time
You're already the person your team turns to when the toughest issues land. Now it's time to lead the desk, develop the team, and help fix what keeps breaking. Weidenhammer is looking for an IT Operations Technical Lead to lead our Cloud & Infrastructure Service Desk while staying hands-on as the senior escalation point across Microsoft 365, Azure, Entra ID, Windows Server, virtualization, networking, backup and disaster recovery, and security. You'll coach and develop service desk analysts and engineers, lead the response when major incidents occur, and drive problem management to eliminate recurring issues at the root. Just as importantly, you'll help shape how we use smarter monitoring, automation, and AI-assisted tools to continually improve the way we deliver managed services to our clients. Have ideas for making operations better? Good. We want them. This is an opportunity to do more than resolve the next ticket. You'll have the ability to improve processes, strengthen the team, and help build a more proactive and efficient service environment. Why Weidenhammer? For nearly 50 years, Weidenhammer has helped middle-market organizations modernize technology, strengthen cybersecurity, and put data and AI to work. We're a senior-led, outcome-driven Microsoft partner with 100+ professionals delivering managed services, cloud, and hosting solutions from our data center footprint in Collegeville, PA, backed by a disaster recovery site in Chandler, AZ. Our technical leads get real responsibility, broad technology exposure, and the opportunity to make an impact. We believe in solving problems the right way, investing in better tools and automation, and creating an environment where people learn from one another and grow. Some of our best professionals started on the service desk and continued building their careers from there. We also offer a competitive benefits package that includes medical, dental, and vision insurance, a 401(k), paid time off, paid parental leave, training and development opportunities, paid volunteer time, wellness programs, and hybrid flexibility. Ready to stop just solving the toughest problems and start leading the way forward? The IT Operations Technical Manager leads the Cloud and Infrastructure Service Desk and serves as the senior hands-on technical escalation point for the operations team supporting Weidenhammer clients. The role combines advanced troubleshooting, technical mentoring, platform administration, documentation, and service improvement across client infrastructure, cloud, identity, endpoint, network, backup, monitoring, and security technologies. Working closely with the Cloud and Infrastructure team, the Manager may be assigned to do complete any of the following: support, mentor, and manage service desk team members, diagnose complex problems, coordinate technical responses during high-impact incidents, validate changes, strengthen monitoring and automation, and ensure new solutions are secure, supportable, and well documented before they enter ongoing support. Essential Functions Manage the Cloud and Infrastructure Service Desk and serve as the senior technical escalation resource for complex incidents and service requests across Microsoft 365, Azure, Windows Server, virtualization, networking, identity, endpoint management, backup, recovery, monitoring, and security operations. Lead structured troubleshooting and root-cause analysis, using logs, telemetry, configuration data, monitoring platforms, and vendor resources to isolate issues and restore service. Provide hands-on technical guidance and coaching to Service Desk Analysts, System Administrators, and Engineers; review troubleshooting approaches, recommend next steps, and strengthen team capability. Coordinate the technical response during major incidents, including triage, workstream assignment, vendor escalation, recovery validation, technical updates, and post-incident corrective actions. Administer, configure, and improve the platforms used to monitor, manage, secure, document, and support client environments within approved access and change-control practices. Develop and maintain technical standards, configuration baselines, build documentation, runbooks, knowledge articles, diagrams, and escalation procedures, along with accurate configuration, asset, licensing, and subscription records in approved service-management and documentation platforms. Review monitoring coverage, alert quality, thresholds, and response procedures to reduce noise and improve early detection of client-impacting conditions. Lead problem management for recurring or high-impact issues, analyzing incident trends, alert patterns, capacity concerns, and platform health data, and implement durable corrective actions (standardized configurations, automation, tool consolidation, documentation, or architectural recommendations) prioritized by risk and client impact. Perform and validate complex changes, maintenance activities, upgrades, migrations, and remediation work, including risk assessment, testing, communication, and rollback planning. Partner with security teams to operationalize identity protection, endpoint security, patching, vulnerability remediation, privileged-access controls, backup and recovery, certificate and lifecycle management, logging, incident response, and evidence requirements across managed environments. Use scripting, workflow automation, APIs, and AI-assisted tools to improve troubleshooting, reporting, configuration consistency, documentation, and repetitive operational work, with appropriate review and governance. Participate in solution reviews and project handoffs and provide technical oversight for transitioning new and changed services into support, identifying supportability concerns, technical debt, and security risks, and validating documentation, monitoring, access, security controls, backup, support ownership, and operational readiness before acceptance. Explain technical conditions, business impact, risks, and recommend next steps in clear language to clients and internal stakeholders, and coordinate with technology vendors and partners, carriers, and third-party support organizations to resolve product defects, service issues, licensing concerns, and complex escalations. Maintain deep working knowledge of the managed-services technology portfolio and pursue role-aligned learning and certifications that support client and service needs. Contribute technical input to client onboarding, assessments, service reviews, proposals, and scope validation when operational expertise is required. Assist with after-hours maintenance and participate in the technical escalation rotation for critical client issues as required. Promote disciplined use of incident, request, problem, change, configuration, knowledge, and continual-improvement practices across the team. Competencies Practical knowledge of IT service management, including incident, major incident, problem, change, request, configuration, knowledge, and continual-improvement practices and the technical evidence required to support them. Advanced hands-on troubleshooting experience across Microsoft 365, Azure, Windows Server, Active Directory and Entra ID, virtualization, networking, endpoint management, backup and recovery, monitoring, and security technologies, including diagnosing complex, multi-layer issues using logs, packet and performance data, telemetry, and configuration analysis. Experience administering remote monitoring and management, IT service-management, documentation, endpoint, identity, backup, security, and observability platforms in an MSP or multi-client environment. Working knowledge of PowerShell or comparable scripting, workflow automation, APIs, and AI-assisted technical tools, with appropriate testing, security, and human review. Strong understanding of identity, least privilege, endpoint protection, vulnerability remediation, logging, backup, recovery, network security, and secure configuration principles. Ability to translate technical findings into clear business impact, risk, recovery options, and recommendations for clients and leadership. Demonstrated judgment during major incidents, production changes, competing priorities, and high-pressure client escalations. Strong technical writing skills, including runbooks, diagrams, build standards, knowledge articles, and post-incident documentation. Ability to lead, mentor, and develop technical professionals, coordinate work across teams, and raise technical quality. Highly organized, self-directed, and accountable, with disciplined change control, validation, and follow-through. Project awareness sufficient to manage technical dependencies, risks, testing, cutover activities, operational acceptance, and stakeholder communication. What Success Looks Like Team members have clear expectations, regular coaching, development plans, and appropriate coverage, and receive practical technical guidance that improves first-contact resolution, escalation quality, and confidence handling increasingly complex work. Recurring issues, manual effort, and avoidable client disruption are measurably reduced through problem management, root-cause analysis, permanent corrective actions, technical standards, automation, and knowledge reuse. Client environments have current monitoring, meaningful alerts, accurate documentation and runbooks, supportable configurations, and clearly defined escalation paths that are consistently followed. . click apply for full job details
Lead the Cloud and Infrastructure Service Desk while serving as the senior escalation point for Microsoft 365, Azure, Entra ID, Windows Server, virtualization, networking, backup and disaster recovery, and security. Coach the technical team, lead major incident response, address recurring problems, and improve managed services through monitoring, automation, and AI-assisted tools. Responsibilities Lead the Cloud and Infrastructure Service Desk. Serve as the senior escalation point for complex technical issues. Coach and develop service desk analysts and engineers. Lead response to major incidents. Drive problem management to prevent recurring issues. Improve service delivery through monitoring, automation, and AI-assisted tools. Required Skills Microsoft 365 Microsoft Azure Microsoft Entra IDWindows Server Virtualization Networking Backup and disaster recovery Cybersecurity Major incident management Problem management
11/09/2026
Full time
Lead the Cloud and Infrastructure Service Desk while serving as the senior escalation point for Microsoft 365, Azure, Entra ID, Windows Server, virtualization, networking, backup and disaster recovery, and security. Coach the technical team, lead major incident response, address recurring problems, and improve managed services through monitoring, automation, and AI-assisted tools. Responsibilities Lead the Cloud and Infrastructure Service Desk. Serve as the senior escalation point for complex technical issues. Coach and develop service desk analysts and engineers. Lead response to major incidents. Drive problem management to prevent recurring issues. Improve service delivery through monitoring, automation, and AI-assisted tools. Required Skills Microsoft 365 Microsoft Azure Microsoft Entra IDWindows Server Virtualization Networking Backup and disaster recovery Cybersecurity Major incident management Problem management
Leidos seeks a Cyber Analyst to protect mission-critical systems for government and commercial clients. In this role, you will monitor networks, investigate incidents, and enhance defenses across complex environments. Responsibilities include threat detection, log and SIEM analysis, incident response, and vulnerability remediation in partnership with engineering and operations teams. You will contribute to secure architectures, support compliance requirements, and prepare clear reports for stakeholders, all within a collaborative, mission-driven culture that values innovation and continuous learning. Responsibilities Monitor networks and systems to detect potential cyber threats and anomalies Investigate security incidents and perform root-cause and impact analysis Implement and tune security tools such as SIEM, IDS/IPS, and endpoint protection Develop and maintain incident response procedures and playbooks Collaborate with cross-functional teams to remediate vulnerabilities and improve defenses Produce clear reports, dashboards, and briefings for technical and non-technical stakeholders Assist with threat hunting, intelligence analysis, and proactive risk identification Support compliance with relevant security standards, policies, and regulations Required Skills Security Information and Event Management (SIEM) tools Network security monitoring and analysis Incident response and forensic investigation Intrusion detection/prevention systems (IDS/IPS) Endpoint protection and EDR platforms Vulnerability assessment and remediation Log analysis and correlation Threat intelligence analysis Knowledge of security frameworks (NIST, ISO 27001) Scripting or automation (Python, Power Shell, or similar)
11/08/2026
Full time
Leidos seeks a Cyber Analyst to protect mission-critical systems for government and commercial clients. In this role, you will monitor networks, investigate incidents, and enhance defenses across complex environments. Responsibilities include threat detection, log and SIEM analysis, incident response, and vulnerability remediation in partnership with engineering and operations teams. You will contribute to secure architectures, support compliance requirements, and prepare clear reports for stakeholders, all within a collaborative, mission-driven culture that values innovation and continuous learning. Responsibilities Monitor networks and systems to detect potential cyber threats and anomalies Investigate security incidents and perform root-cause and impact analysis Implement and tune security tools such as SIEM, IDS/IPS, and endpoint protection Develop and maintain incident response procedures and playbooks Collaborate with cross-functional teams to remediate vulnerabilities and improve defenses Produce clear reports, dashboards, and briefings for technical and non-technical stakeholders Assist with threat hunting, intelligence analysis, and proactive risk identification Support compliance with relevant security standards, policies, and regulations Required Skills Security Information and Event Management (SIEM) tools Network security monitoring and analysis Incident response and forensic investigation Intrusion detection/prevention systems (IDS/IPS) Endpoint protection and EDR platforms Vulnerability assessment and remediation Log analysis and correlation Threat intelligence analysis Knowledge of security frameworks (NIST, ISO 27001) Scripting or automation (Python, Power Shell, or similar)
Leidos seeks a Cyber Infrastructure Support Lead to oversee secure, resilient operations for complex, mission-critical IT environments. In this role, you will lead a small team supporting networks, servers, and cloud platforms, ensuring availability, performance, and cyber readiness for government and commercial clients. Responsibilities include incident response, problem resolution, security hardening, patching, and coordinating upgrades and migrations. You will collaborate closely with cyber, engineering, and operations teams, maintain documentation and SLAs, and mentor staff in a highly collaborative, mission-focused culture. Responsibilities Lead day-to-day cyber infrastructure support operations for mission-critical systems Oversee monitoring, incident response, and troubleshooting across networks and cloud environments Implement security controls, hardening, and patch management aligned with best practices Coordinate with cybersecurity, engineering, and operations teams to resolve complex issues Develop and maintain runbooks, SOPs, and documentation for supported environments Provide technical guidance and mentoring to support engineers and analysts Support planning and execution of infrastructure upgrades and modernization efforts Ensure compliance with government and industry security standards and SLAs Required Skills Cyber infrastructure operations Network administration (LAN/WAN, routing, switching) Linux/Windows server administration Cloud platforms (AWS, Azure, or similar) Security monitoring and incident response SIEM and log analysis tools Vulnerability management and patching Scripting/automation (Power Shell, Python, or similar) Configuration management and documentation Compliance with government/industry security standards
11/08/2026
Full time
Leidos seeks a Cyber Infrastructure Support Lead to oversee secure, resilient operations for complex, mission-critical IT environments. In this role, you will lead a small team supporting networks, servers, and cloud platforms, ensuring availability, performance, and cyber readiness for government and commercial clients. Responsibilities include incident response, problem resolution, security hardening, patching, and coordinating upgrades and migrations. You will collaborate closely with cyber, engineering, and operations teams, maintain documentation and SLAs, and mentor staff in a highly collaborative, mission-focused culture. Responsibilities Lead day-to-day cyber infrastructure support operations for mission-critical systems Oversee monitoring, incident response, and troubleshooting across networks and cloud environments Implement security controls, hardening, and patch management aligned with best practices Coordinate with cybersecurity, engineering, and operations teams to resolve complex issues Develop and maintain runbooks, SOPs, and documentation for supported environments Provide technical guidance and mentoring to support engineers and analysts Support planning and execution of infrastructure upgrades and modernization efforts Ensure compliance with government and industry security standards and SLAs Required Skills Cyber infrastructure operations Network administration (LAN/WAN, routing, switching) Linux/Windows server administration Cloud platforms (AWS, Azure, or similar) Security monitoring and incident response SIEM and log analysis tools Vulnerability management and patching Scripting/automation (Power Shell, Python, or similar) Configuration management and documentation Compliance with government/industry security standards
Leidos is seeking a Cyber Infrastructure Support professional to ensure the resilience of mission-critical systems for government and commercial clients. In this role, you will monitor and support networks, servers, and security tools, investigating incidents and applying hardening, patching, and configuration baselines. You'll collaborate with cross-functional teams to improve reliability and cyber posture, maintain documentation and runbooks, and support 24x7 operations as needed. Join a mission-driven, learning-focused environment with flexible work options and impactful national security and critical infrastructure projects. Responsibilities Monitor and support critical cyber and IT infrastructure for availability, performance, and security. Investigate, triage, and resolve security and operational incidents within defined SLAs. Implement hardening, patching, and configuration baselines across servers, networks, and endpoints. Maintain and tune monitoring, logging, and SIEM tools to improve threat detection. Collaborate with engineers, analysts, and stakeholders to support mission-critical programs. Create and maintain technical documentation, runbooks, and system diagrams. Support change management activities, including testing and deployment of infrastructure changes. Participate in on-call or shift coverage for 24x7 operations as needed. Required Skills Cybersecurity operations Network infrastructure support Linux/Windows administration SIEM tools (e.g., Splunk) Incident detection and response Vulnerability assessment Firewalls and IDS/IPSScripting/automation (Python, Power Shell) Cloud security (AWS/Azure) Documentation and reporting
11/08/2026
Full time
Leidos is seeking a Cyber Infrastructure Support professional to ensure the resilience of mission-critical systems for government and commercial clients. In this role, you will monitor and support networks, servers, and security tools, investigating incidents and applying hardening, patching, and configuration baselines. You'll collaborate with cross-functional teams to improve reliability and cyber posture, maintain documentation and runbooks, and support 24x7 operations as needed. Join a mission-driven, learning-focused environment with flexible work options and impactful national security and critical infrastructure projects. Responsibilities Monitor and support critical cyber and IT infrastructure for availability, performance, and security. Investigate, triage, and resolve security and operational incidents within defined SLAs. Implement hardening, patching, and configuration baselines across servers, networks, and endpoints. Maintain and tune monitoring, logging, and SIEM tools to improve threat detection. Collaborate with engineers, analysts, and stakeholders to support mission-critical programs. Create and maintain technical documentation, runbooks, and system diagrams. Support change management activities, including testing and deployment of infrastructure changes. Participate in on-call or shift coverage for 24x7 operations as needed. Required Skills Cybersecurity operations Network infrastructure support Linux/Windows administration SIEM tools (e.g., Splunk) Incident detection and response Vulnerability assessment Firewalls and IDS/IPSScripting/automation (Python, Power Shell) Cloud security (AWS/Azure) Documentation and reporting
cFocus Software Incorporated
Linthicum Heights, Maryland
Job Description Job Description cFocus Software seeks a SOC Lead to join our program supporting the United States Air Force (USAF). This position is on-site in Linthicum Heights, MD. This position requires an Active TS/SCI clearance. Qualifications: Active TS/SCI clearance B.S. Computer Science, Information Technology, or a related field Experience leading SOC personnel or comparable defensive cybersecurity operations. Experience directing alert triage, threat hunting, investigations, and incident response. Ability to manage operational priorities, analyst development, coverage, and handoffs. Knowledge of networks, endpoints, cloud environments, logs, and common cyberattack techniques. Experience with security monitoring, endpoint detection, vulnerability tools, and detection tuning. Ability to coordinate remediation and response across operations, engineering, and cybersecurity teams. Understanding of evidence handling, secure configurations, compliance records, and operational risk. Strong judgment and communication skills for timely Government reporting and incident coordination Duties: Lead SOC analysts and assigned response personnel; prioritize work, coach staff, review investigations, and maintain clear accountability for operational actions. Plan assigned staffing, coverage, on-call rotations, and handoffs to support required on-site and global response capabilities. Support SOC stand-up planning, tool configuration, sensor integration with command and control (C2) nodes, and enterprise scanning readiness. Coordinate centralized defensive operations, including monitoring, penetration testing support, threat hunting, cyber orders and taskers, and incident response. Oversee alert triage and analysis of security events and trends; validate findings, assess mission impact, and direct approved mitigation actions. Lead data and intelligence-driven threat hunting and anomaly investigations across DC3 information technology (IT) and operational technology (OT) environments. Direct incident detection, investigation, escalation, and approved containment, eradication, and recovery; keep Government stakeholders informed under established procedures. Review investigation evidence, incident timelines, and reports for accuracy and completeness; ensure response actions and handoffs are documented. Coordinate weekly vulnerability assessments with certified specialists; prioritize findings and track remediation with infrastructure, application, and cybersecurity teams. Maintain effective C2 coordination with Cybersecurity Service Providers (CSSPs), the AFCYBER Operations Center, and applicable higher headquarters authorities. Manage assigned cyber orders and taskers, coordinate implementation, and support required compliance documentation and Plans of Action and Milestones (POA&Ms). Assess SOC tools, telemetry coverage, and resource needs; recommend procurement and operational improvements through approved Government processes. Maintain incident response procedures, escalation guides, and operational documentation; incorporate lessons learned and submit required updates for Government approval. Coordinate with ISSOs and the ISSM to provide monitoring evidence and remediation status supporting RMF, authorization, and enterprise risk activities. Recommend improvements based on emerging threats, cybersecurity practices, and technologies, including benefits, risks, and implementation approaches. Powered by JazzHR atVWjQ7N5H
11/08/2026
Full time
Job Description Job Description cFocus Software seeks a SOC Lead to join our program supporting the United States Air Force (USAF). This position is on-site in Linthicum Heights, MD. This position requires an Active TS/SCI clearance. Qualifications: Active TS/SCI clearance B.S. Computer Science, Information Technology, or a related field Experience leading SOC personnel or comparable defensive cybersecurity operations. Experience directing alert triage, threat hunting, investigations, and incident response. Ability to manage operational priorities, analyst development, coverage, and handoffs. Knowledge of networks, endpoints, cloud environments, logs, and common cyberattack techniques. Experience with security monitoring, endpoint detection, vulnerability tools, and detection tuning. Ability to coordinate remediation and response across operations, engineering, and cybersecurity teams. Understanding of evidence handling, secure configurations, compliance records, and operational risk. Strong judgment and communication skills for timely Government reporting and incident coordination Duties: Lead SOC analysts and assigned response personnel; prioritize work, coach staff, review investigations, and maintain clear accountability for operational actions. Plan assigned staffing, coverage, on-call rotations, and handoffs to support required on-site and global response capabilities. Support SOC stand-up planning, tool configuration, sensor integration with command and control (C2) nodes, and enterprise scanning readiness. Coordinate centralized defensive operations, including monitoring, penetration testing support, threat hunting, cyber orders and taskers, and incident response. Oversee alert triage and analysis of security events and trends; validate findings, assess mission impact, and direct approved mitigation actions. Lead data and intelligence-driven threat hunting and anomaly investigations across DC3 information technology (IT) and operational technology (OT) environments. Direct incident detection, investigation, escalation, and approved containment, eradication, and recovery; keep Government stakeholders informed under established procedures. Review investigation evidence, incident timelines, and reports for accuracy and completeness; ensure response actions and handoffs are documented. Coordinate weekly vulnerability assessments with certified specialists; prioritize findings and track remediation with infrastructure, application, and cybersecurity teams. Maintain effective C2 coordination with Cybersecurity Service Providers (CSSPs), the AFCYBER Operations Center, and applicable higher headquarters authorities. Manage assigned cyber orders and taskers, coordinate implementation, and support required compliance documentation and Plans of Action and Milestones (POA&Ms). Assess SOC tools, telemetry coverage, and resource needs; recommend procurement and operational improvements through approved Government processes. Maintain incident response procedures, escalation guides, and operational documentation; incorporate lessons learned and submit required updates for Government approval. Coordinate with ISSOs and the ISSM to provide monitoring evidence and remediation status supporting RMF, authorization, and enterprise risk activities. Recommend improvements based on emerging threats, cybersecurity practices, and technologies, including benefits, risks, and implementation approaches. Powered by JazzHR atVWjQ7N5H
This job is with Gilead Sciences Inc., an inclusive employer and a member of myGwork - the largest global platform for the LGBTQ+ business community. Please do not contact the recruiter directly. At Gilead, we're creating a healthier world for all people. For more than 35 years, we've tackled diseases such as HIV, viral hepatitis, COVID-19 and cancer - working relentlessly to develop therapies that help improve lives and to ensure access to these therapies across the globe. We continue to fight against the world's biggest health challenges, and our mission requires collaboration, determination and a relentless drive to make a difference. Every member of Gilead's team plays a critical role in the discovery and development of life-changing scientific innovations. Our employees are our greatest asset as we work to achieve our bold ambitions, and we're looking for the next wave of passionate and ambitious people ready to make a direct impact. We believe every employee deserves a great leader. People Leaders are the cornerstone to the employee experience at Gilead and Kite. As a people leader now or in the future, you are the key driver in evolving our culture and creating an environment where every employee feels included, developed and empowered to fulfill their aspirations. Join Gilead and help create possible, together. Job Description Key Responsibilities Validation and assurance strategy Develop risk-based validation or assurance plans based on intended use, GxP impact, process risk, system complexity, novelty, and supplier capability. Define lifecycle deliverables, acceptance criteria, evidence expectations, roles, and approval requirements. Apply critical thinking to focus effort on functions that could affect patient safety, product quality, record reliability, or regulatory compliance. Use supplier documentation and automated evidence when suitable, complete, reliable, and approved for use. Lifecycle execution and oversight Lead or approve GxP assessments, validation plans, user requirements, specifications, risk assessments, traceability, test strategies, test evidence, summary reports, and release decisions. Ensure requirements are clear, testable, risk-based, and traceable to objective evidence. Oversee scripted, unscripted, exploratory, scenario-based, automated, and regression testing as appropriate. Assess deviations, defects, residual risks, and corrective actions and confirm readiness before production use. Ensure configuration, interfaces, data migration, reports, calculations, workflows, security roles, electronic signatures, and audit trails are adequately verified. Validated-state maintenance Provide assurance oversight for changes, upgrades, patches, releases, incidents, periodic reviews, access reviews, backup and restore, business continuity, and system retirement. Evaluate change impact and regression needs using documented process and technical risk. Monitor validation health, overdue actions, recurring defects, supplier performance, and inspection-readiness indicators. Ensure archived data and records remain accessible, readable, complete, and protected throughout required retention periods. Data integrity and electronic records Assess controls for data creation, modification, review, approval, transfer, storage, reporting, retention, and deletion. Verify appropriate controls for attribution, contemporaneous recording, original records, accuracy, completeness, consistency, enduring retention, and availability. Ensure audit-trail requirements, review procedures, record ownership, metadata, and exception handling are defined and tested. Supplier and technology assurance Lead supplier assessments and determine how supplier quality systems, development practices, testing, certifications, and service controls may be leveraged. Evaluate SaaS, cloud, infrastructure, platform, low-code, automation, analytics, and AI solutions for applicable GxP and data-integrity risks. Define assurance expectations in quality agreements, service agreements, contracts, and support models. Confirm responsibilities for releases, incidents, security, backup, continuity, data return, and service termination. Governance, standards, and inspection readiness Maintain validation standards, templates, procedures, decision trees, risk models, and training materials. Provide independent Quality review and approval while preserving clear accountability for process owners, system owners, IT, and suppliers. Support internal audits, regulatory inspections, due diligence, and responses to observations. Track and communicate validation metrics, risks, resource needs, and remediation progress to governance bodies. Leadership and capability development Lead validation workstreams and coach validation specialists, business analysts, testers, process owners, and technical teams. Estimate effort, assign work, monitor deliverables, and resolve quality, schedule, and resource issues. Promote standardized, efficient, and evidence-based assurance practices across functions and sites. Monitor regulatory and industry developments and translate them into practical lifecycle controls. Required Qualifications Bachelor's degree in life sciences, engineering, computer science, information systems, Quality, or a related discipline. At least 8 years of experience in computer system validation, computer software assurance, Quality systems, information technology, or a related regulated function. Experience in a pharmaceutical, biotechnology, medical device, clinical, laboratory, manufacturing, or other regulated life-sciences environment. Demonstrated experience leading validation for enterprise or site-based GxP computerized systems. Practical knowledge of risk-based lifecycle assurance, data integrity, electronic records and signatures, and applicable validation regulations and guidance. Experience authoring or approving validation plans, requirements, risk assessments, traceability, test protocols or scripts, deviations, and summary reports. Experience with change control, incident management, periodic review, access controls, audit trails, data migration, interfaces, and system retirement. Ability to assess suppliers and determine appropriate use of supplier documentation and testing evidence. Strong technical writing, problem-solving, facilitation, project-management, and stakeholder-management skills. Ability to lead cross-functional teams and make documented, risk-based decisions. Ability to travel as needed. Preferred Qualifications Advanced degree in life sciences, engineering, information systems, Quality, or a related discipline. Professional certification related to Quality, auditing, project management, software testing, information security, or computer system validation. Experience with quality management, laboratory, manufacturing, enterprise resource planning, clinical, regulatory, document, learning, or data and analytics platforms. Experience validating SaaS, cloud, low-code, robotic process automation, advanced analytics, or AI-enabled solutions. Experience with agile or iterative delivery models and automated testing approaches. Experience supporting global deployments, regulatory inspections, remediation programs, data migrations, or complex system integrations. Knowledge of product management, enterprise architecture, cybersecurity, privacy, and data-governance practices. Experience developing validation procedures, templates, training, metrics, and communities of practice. Required Knowledge and Skills Ability to connect intended use, process knowledge, system functionality, and patient, product, and data risks. Ability to distinguish GxP impact, business criticality, software complexity, and process risk and avoid using software category alone to determine validation rigor. Knowledge of requirements management, risk assessment, testing techniques, traceability, defect management, and objective evidence. Knowledge of data-integrity principles, electronic records, electronic signatures, metadata, audit trails, security, and record retention. Understanding of configurable and custom software, integrations, infrastructure, cloud service models, automation, analytics, and emerging technologies. Ability to review technical and Quality documentation for adequacy, consistency, traceability, and approval readiness. Ability to explain validation expectations clearly to technical and nontechnical stakeholders. Sound judgment, attention to detail, independence, and the ability to manage competing priorities The salary range for this position is: Other US Locations: $191,250.00 - $247,500.00. Bay Area: $210,375.00 - $272,250.00. Gilead considers a variety of factors when determining base compensation, including experience, qualifications, and geographic location. These considerations mean actual compensation will vary. This position may also be eligible for a discretionary annual bonus, discretionary stock-based long-term incentives (eligibility may vary based on role), paid time off, and a benefits package. Benefits include company-sponsored medical, dental, vision, and life insurance plans . For additional benefits information, visit: . click apply for full job details
11/08/2026
Full time
This job is with Gilead Sciences Inc., an inclusive employer and a member of myGwork - the largest global platform for the LGBTQ+ business community. Please do not contact the recruiter directly. At Gilead, we're creating a healthier world for all people. For more than 35 years, we've tackled diseases such as HIV, viral hepatitis, COVID-19 and cancer - working relentlessly to develop therapies that help improve lives and to ensure access to these therapies across the globe. We continue to fight against the world's biggest health challenges, and our mission requires collaboration, determination and a relentless drive to make a difference. Every member of Gilead's team plays a critical role in the discovery and development of life-changing scientific innovations. Our employees are our greatest asset as we work to achieve our bold ambitions, and we're looking for the next wave of passionate and ambitious people ready to make a direct impact. We believe every employee deserves a great leader. People Leaders are the cornerstone to the employee experience at Gilead and Kite. As a people leader now or in the future, you are the key driver in evolving our culture and creating an environment where every employee feels included, developed and empowered to fulfill their aspirations. Join Gilead and help create possible, together. Job Description Key Responsibilities Validation and assurance strategy Develop risk-based validation or assurance plans based on intended use, GxP impact, process risk, system complexity, novelty, and supplier capability. Define lifecycle deliverables, acceptance criteria, evidence expectations, roles, and approval requirements. Apply critical thinking to focus effort on functions that could affect patient safety, product quality, record reliability, or regulatory compliance. Use supplier documentation and automated evidence when suitable, complete, reliable, and approved for use. Lifecycle execution and oversight Lead or approve GxP assessments, validation plans, user requirements, specifications, risk assessments, traceability, test strategies, test evidence, summary reports, and release decisions. Ensure requirements are clear, testable, risk-based, and traceable to objective evidence. Oversee scripted, unscripted, exploratory, scenario-based, automated, and regression testing as appropriate. Assess deviations, defects, residual risks, and corrective actions and confirm readiness before production use. Ensure configuration, interfaces, data migration, reports, calculations, workflows, security roles, electronic signatures, and audit trails are adequately verified. Validated-state maintenance Provide assurance oversight for changes, upgrades, patches, releases, incidents, periodic reviews, access reviews, backup and restore, business continuity, and system retirement. Evaluate change impact and regression needs using documented process and technical risk. Monitor validation health, overdue actions, recurring defects, supplier performance, and inspection-readiness indicators. Ensure archived data and records remain accessible, readable, complete, and protected throughout required retention periods. Data integrity and electronic records Assess controls for data creation, modification, review, approval, transfer, storage, reporting, retention, and deletion. Verify appropriate controls for attribution, contemporaneous recording, original records, accuracy, completeness, consistency, enduring retention, and availability. Ensure audit-trail requirements, review procedures, record ownership, metadata, and exception handling are defined and tested. Supplier and technology assurance Lead supplier assessments and determine how supplier quality systems, development practices, testing, certifications, and service controls may be leveraged. Evaluate SaaS, cloud, infrastructure, platform, low-code, automation, analytics, and AI solutions for applicable GxP and data-integrity risks. Define assurance expectations in quality agreements, service agreements, contracts, and support models. Confirm responsibilities for releases, incidents, security, backup, continuity, data return, and service termination. Governance, standards, and inspection readiness Maintain validation standards, templates, procedures, decision trees, risk models, and training materials. Provide independent Quality review and approval while preserving clear accountability for process owners, system owners, IT, and suppliers. Support internal audits, regulatory inspections, due diligence, and responses to observations. Track and communicate validation metrics, risks, resource needs, and remediation progress to governance bodies. Leadership and capability development Lead validation workstreams and coach validation specialists, business analysts, testers, process owners, and technical teams. Estimate effort, assign work, monitor deliverables, and resolve quality, schedule, and resource issues. Promote standardized, efficient, and evidence-based assurance practices across functions and sites. Monitor regulatory and industry developments and translate them into practical lifecycle controls. Required Qualifications Bachelor's degree in life sciences, engineering, computer science, information systems, Quality, or a related discipline. At least 8 years of experience in computer system validation, computer software assurance, Quality systems, information technology, or a related regulated function. Experience in a pharmaceutical, biotechnology, medical device, clinical, laboratory, manufacturing, or other regulated life-sciences environment. Demonstrated experience leading validation for enterprise or site-based GxP computerized systems. Practical knowledge of risk-based lifecycle assurance, data integrity, electronic records and signatures, and applicable validation regulations and guidance. Experience authoring or approving validation plans, requirements, risk assessments, traceability, test protocols or scripts, deviations, and summary reports. Experience with change control, incident management, periodic review, access controls, audit trails, data migration, interfaces, and system retirement. Ability to assess suppliers and determine appropriate use of supplier documentation and testing evidence. Strong technical writing, problem-solving, facilitation, project-management, and stakeholder-management skills. Ability to lead cross-functional teams and make documented, risk-based decisions. Ability to travel as needed. Preferred Qualifications Advanced degree in life sciences, engineering, information systems, Quality, or a related discipline. Professional certification related to Quality, auditing, project management, software testing, information security, or computer system validation. Experience with quality management, laboratory, manufacturing, enterprise resource planning, clinical, regulatory, document, learning, or data and analytics platforms. Experience validating SaaS, cloud, low-code, robotic process automation, advanced analytics, or AI-enabled solutions. Experience with agile or iterative delivery models and automated testing approaches. Experience supporting global deployments, regulatory inspections, remediation programs, data migrations, or complex system integrations. Knowledge of product management, enterprise architecture, cybersecurity, privacy, and data-governance practices. Experience developing validation procedures, templates, training, metrics, and communities of practice. Required Knowledge and Skills Ability to connect intended use, process knowledge, system functionality, and patient, product, and data risks. Ability to distinguish GxP impact, business criticality, software complexity, and process risk and avoid using software category alone to determine validation rigor. Knowledge of requirements management, risk assessment, testing techniques, traceability, defect management, and objective evidence. Knowledge of data-integrity principles, electronic records, electronic signatures, metadata, audit trails, security, and record retention. Understanding of configurable and custom software, integrations, infrastructure, cloud service models, automation, analytics, and emerging technologies. Ability to review technical and Quality documentation for adequacy, consistency, traceability, and approval readiness. Ability to explain validation expectations clearly to technical and nontechnical stakeholders. Sound judgment, attention to detail, independence, and the ability to manage competing priorities The salary range for this position is: Other US Locations: $191,250.00 - $247,500.00. Bay Area: $210,375.00 - $272,250.00. Gilead considers a variety of factors when determining base compensation, including experience, qualifications, and geographic location. These considerations mean actual compensation will vary. This position may also be eligible for a discretionary annual bonus, discretionary stock-based long-term incentives (eligibility may vary based on role), paid time off, and a benefits package. Benefits include company-sponsored medical, dental, vision, and life insurance plans . For additional benefits information, visit: . click apply for full job details
Job Description Job Description About Netcraft Netcraft is the global leader in cybercrime detection and disruption. We're a trusted partner for three of the four largest companies in the world and many large governments. We've blocked over 225 million cyber-attacks to date, and we take down around 33% of the world's phishing attacks. Our purpose and passion are focused on just one thing: protecting the world from cybercrime. That passion shapes how we work, too. We're proud of our talented team and the value each person brings, and we've built a workplace where people feel supported and inspired. From strong benefits and wellness programs to meaningful collaboration and team connection. About Netcraft Netcraft is the global leader in cybercrime detection and disruption. We're a trusted partner for three of the four largest companies in the world, and many large country governments. We've blocked almost 200 million cyber-attacks to date, and we take down around 33% of the world's phishing attacks. Our purpose and passion are focused on just one thing: protecting the world from cybercrime. Our passion doesn't stop at what we do - it shapes how we work, too. We're proud of our talented team and the value each person brings. That's why we've created a workplace where people feel supported and inspired, from great benefits and wellness programs to fun social events. The Role We're seeking a Cybercrime Analyst to join our amazing Technical Operations team. Cybercrime Analysts have an opportunity to make a real difference in the world by identifying threats and acting to protect governments, banks, and consumers from online attacks. You'll be a key part of the incident response team, finding innovative ways to rapidly disrupt cyber-attacks against our clients. And don't worry if you have limited experience in this area: we can train you. Day to day, your responsibilities will include: Cybercrime incident response - communicating analysis of cyber threats to relevant parties to mitigate attacks; Classification of malicious websites, social media profiles, apps, emails, and phone numbers; Providing clear and professional feedback to customers on incidents and classifications; Sharing your ideas on how to improve processes and workflows. Based at our Lehi office three times a week (Tuesday, Wednesday and Thursday are in the office, with flexibility on Monday and Friday), you'll report directly to a Technical Operations Team Lead and will work closely with colleagues across our global offices. To be successful, you'll need Attention to detail, adaptability, and strong intellectual and commercial curiosity; A positive and solution-focused approach; Interest in the internet and cybercrime prevention; Excellent communication skills with a high standard of written English; Ability to engage with people in a warm, helpful, and professional way; Self-motivation, ability to take initiative, and work as part of a team; Aptitude for analysing and using technical information; Competence in handling incoming phone calls; Some experience in cybersecurity is useful but not essential as full training will be provided; A degree in a relevant area, such as Cyber Security, Computer Science or IT may be useful but isn't essential. The reward package A salary of $50,000 USD, reviewed annually 33 days of vacation, including national holidays (which can be worked if you prefer) Generous enhanced family leave and pay Enhanced company sick pay from day one of employment, with additional support after your first six months' service Equity Tracking Units, allowing you to share in Netcraft's long-term success (eligibility criteria apply) Hybrid and flexible working options 401(k) Safe Harbor Plan with employer match Comprehensive private health cover, including medical, dental, vision, and life insurance Meals, snacks, and drinks provided in the office Two paid Learning & Development days per year, plus access to learning resources such as Udemy and Coursera Two paid Volunteering Days per year to support causes that matter to you Spot reward bonus scheme recognizing outstanding contributions Employee Referral Bonus Scheme Your standard working days will be Monday to Friday, 9AM-6PM. We may also require you to work weekend shifts and non-standard hours on occasion. This is because Netcraft protects its customers 24/7, 365, which we'll discuss with you at interview. If you think this role is for you, please apply. We'd love to hear from you. Diversity, Equity and Inclusion This is very important to us and through our ally network we support under-represented groups. We seek to maintain a working environment that is free from bias, harassment or discrimination, and we encourage candidates from any background to apply, regardless of their gender, gender identity, sexual orientation, race/ethnicity, ability/disability, age, religion, or any other specific characteristics. We're happy to make any adjustments to our hiring process to ensure that all candidates can participate fully and comfortably. Please note Netcraft does not accept any unsolicited approaches from external recruiters. Diversity, Equity & Inclusion This is deeply important to us. Through our ally network, we support under-represented groups and maintain a working environment free from bias, harassment, or discrimination. We encourage candidates from all backgrounds to apply. We're also happy to make adjustments to the hiring process to ensure every candidate can participate fully. Please note: Netcraft does not accept unsolicited approaches from external recruiters.
11/06/2026
Full time
Job Description Job Description About Netcraft Netcraft is the global leader in cybercrime detection and disruption. We're a trusted partner for three of the four largest companies in the world and many large governments. We've blocked over 225 million cyber-attacks to date, and we take down around 33% of the world's phishing attacks. Our purpose and passion are focused on just one thing: protecting the world from cybercrime. That passion shapes how we work, too. We're proud of our talented team and the value each person brings, and we've built a workplace where people feel supported and inspired. From strong benefits and wellness programs to meaningful collaboration and team connection. About Netcraft Netcraft is the global leader in cybercrime detection and disruption. We're a trusted partner for three of the four largest companies in the world, and many large country governments. We've blocked almost 200 million cyber-attacks to date, and we take down around 33% of the world's phishing attacks. Our purpose and passion are focused on just one thing: protecting the world from cybercrime. Our passion doesn't stop at what we do - it shapes how we work, too. We're proud of our talented team and the value each person brings. That's why we've created a workplace where people feel supported and inspired, from great benefits and wellness programs to fun social events. The Role We're seeking a Cybercrime Analyst to join our amazing Technical Operations team. Cybercrime Analysts have an opportunity to make a real difference in the world by identifying threats and acting to protect governments, banks, and consumers from online attacks. You'll be a key part of the incident response team, finding innovative ways to rapidly disrupt cyber-attacks against our clients. And don't worry if you have limited experience in this area: we can train you. Day to day, your responsibilities will include: Cybercrime incident response - communicating analysis of cyber threats to relevant parties to mitigate attacks; Classification of malicious websites, social media profiles, apps, emails, and phone numbers; Providing clear and professional feedback to customers on incidents and classifications; Sharing your ideas on how to improve processes and workflows. Based at our Lehi office three times a week (Tuesday, Wednesday and Thursday are in the office, with flexibility on Monday and Friday), you'll report directly to a Technical Operations Team Lead and will work closely with colleagues across our global offices. To be successful, you'll need Attention to detail, adaptability, and strong intellectual and commercial curiosity; A positive and solution-focused approach; Interest in the internet and cybercrime prevention; Excellent communication skills with a high standard of written English; Ability to engage with people in a warm, helpful, and professional way; Self-motivation, ability to take initiative, and work as part of a team; Aptitude for analysing and using technical information; Competence in handling incoming phone calls; Some experience in cybersecurity is useful but not essential as full training will be provided; A degree in a relevant area, such as Cyber Security, Computer Science or IT may be useful but isn't essential. The reward package A salary of $50,000 USD, reviewed annually 33 days of vacation, including national holidays (which can be worked if you prefer) Generous enhanced family leave and pay Enhanced company sick pay from day one of employment, with additional support after your first six months' service Equity Tracking Units, allowing you to share in Netcraft's long-term success (eligibility criteria apply) Hybrid and flexible working options 401(k) Safe Harbor Plan with employer match Comprehensive private health cover, including medical, dental, vision, and life insurance Meals, snacks, and drinks provided in the office Two paid Learning & Development days per year, plus access to learning resources such as Udemy and Coursera Two paid Volunteering Days per year to support causes that matter to you Spot reward bonus scheme recognizing outstanding contributions Employee Referral Bonus Scheme Your standard working days will be Monday to Friday, 9AM-6PM. We may also require you to work weekend shifts and non-standard hours on occasion. This is because Netcraft protects its customers 24/7, 365, which we'll discuss with you at interview. If you think this role is for you, please apply. We'd love to hear from you. Diversity, Equity and Inclusion This is very important to us and through our ally network we support under-represented groups. We seek to maintain a working environment that is free from bias, harassment or discrimination, and we encourage candidates from any background to apply, regardless of their gender, gender identity, sexual orientation, race/ethnicity, ability/disability, age, religion, or any other specific characteristics. We're happy to make any adjustments to our hiring process to ensure that all candidates can participate fully and comfortably. Please note Netcraft does not accept any unsolicited approaches from external recruiters. Diversity, Equity & Inclusion This is deeply important to us. Through our ally network, we support under-represented groups and maintain a working environment free from bias, harassment, or discrimination. We encourage candidates from all backgrounds to apply. We're also happy to make adjustments to the hiring process to ensure every candidate can participate fully. Please note: Netcraft does not accept unsolicited approaches from external recruiters.
Job Description Job Description Network Security Engineer Job Description Applicants must be authorized to work in the U.S. without sponsorship now and in the future. The company does not offer visa sponsorship or transfer of visas for this position now or in the future. The Network Security Engineer is responsible for supporting and securing the organization's enterprise and manufacturing network infrastructure. This position combines traditional network engineering responsibilities with cybersecurity functions to ensure the confidentiality, integrity, and availability of both Information Technology (IT) and Operational Technology (OT) environments. The ideal candidate will have a strong background in Cisco technologies, be hands-on, detail-oriented, and able to work effectively in a fast-paced manufacturing environment. Essential Duties and Responsibilities: Design, implement, and maintain Cisco-based LAN/WAN infrastructure across enterprise and manufacturing environments. Configure, manage, and troubleshoot Cisco routers, switches, wireless infrastructure, and network appliances. Monitor and analyze network performance to ensure high availability and reliability. Support OT and IT network segmentation initiatives to maintain operational security and uptime. Perform network upgrades, capacity planning, and infrastructure optimization. Maintain accurate network documentation, diagrams, and standard operating procedures (SOPs). Assist with day-to-day break/fix network incidents and escalated support requests Administer and support firewalls, VPNs, and other network security technologies. Monitor security alerts and investigate suspicious activity across enterprise and OT environments. Assist with vulnerability management, remediation efforts, and patch management processes. Participate in security incident response activities and support compliance initiatives. Manage and support multi-factor authentication (MFA), secure remote access solutions, and access control technologies. Collaborate with IT and operational teams to implement and maintain security best practices. Support cybersecurity compliance efforts and contribute to security audits and assessments. Required Skills and Qualifications: Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field; or equivalent practical experience. Minimum 5 years of professional networking experience. Minimum 3-5 years of cybersecurity experience. Strong hands-on expertise with Cisco networking technologies. Experience with firewalls, VPNs, IDS/IPS, network segmentation, authentication technologies, and access controls. Strong understanding of network security principles and best practices. Manufacturing environment experience preferred with an understanding of industrial and OT network requirements. Excellent troubleshooting, documentation, and communication skills. Ability to work onsite with cross-functional teams in a manufacturing environment. -no remote option. Proficiency in Mandarin Preferred Skills and Qualifications: Cisco Certified Network Associate (CCNA) CompTIA Network+ CompTIA Security+ CiscoCyberOpsAssociate Microsoft SC-200 Security Operations Analyst Microsoft SC-300 Identity and Access Administrator Additional Cisco security or networking certifications preferred This job description is intended to provide a general overview of the position. It is not intended to be an exhaustive list of all responsibilities, duties, and skills required. The company reserves the right to modify or change the job description at any time.
11/06/2026
Full time
Job Description Job Description Network Security Engineer Job Description Applicants must be authorized to work in the U.S. without sponsorship now and in the future. The company does not offer visa sponsorship or transfer of visas for this position now or in the future. The Network Security Engineer is responsible for supporting and securing the organization's enterprise and manufacturing network infrastructure. This position combines traditional network engineering responsibilities with cybersecurity functions to ensure the confidentiality, integrity, and availability of both Information Technology (IT) and Operational Technology (OT) environments. The ideal candidate will have a strong background in Cisco technologies, be hands-on, detail-oriented, and able to work effectively in a fast-paced manufacturing environment. Essential Duties and Responsibilities: Design, implement, and maintain Cisco-based LAN/WAN infrastructure across enterprise and manufacturing environments. Configure, manage, and troubleshoot Cisco routers, switches, wireless infrastructure, and network appliances. Monitor and analyze network performance to ensure high availability and reliability. Support OT and IT network segmentation initiatives to maintain operational security and uptime. Perform network upgrades, capacity planning, and infrastructure optimization. Maintain accurate network documentation, diagrams, and standard operating procedures (SOPs). Assist with day-to-day break/fix network incidents and escalated support requests Administer and support firewalls, VPNs, and other network security technologies. Monitor security alerts and investigate suspicious activity across enterprise and OT environments. Assist with vulnerability management, remediation efforts, and patch management processes. Participate in security incident response activities and support compliance initiatives. Manage and support multi-factor authentication (MFA), secure remote access solutions, and access control technologies. Collaborate with IT and operational teams to implement and maintain security best practices. Support cybersecurity compliance efforts and contribute to security audits and assessments. Required Skills and Qualifications: Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field; or equivalent practical experience. Minimum 5 years of professional networking experience. Minimum 3-5 years of cybersecurity experience. Strong hands-on expertise with Cisco networking technologies. Experience with firewalls, VPNs, IDS/IPS, network segmentation, authentication technologies, and access controls. Strong understanding of network security principles and best practices. Manufacturing environment experience preferred with an understanding of industrial and OT network requirements. Excellent troubleshooting, documentation, and communication skills. Ability to work onsite with cross-functional teams in a manufacturing environment. -no remote option. Proficiency in Mandarin Preferred Skills and Qualifications: Cisco Certified Network Associate (CCNA) CompTIA Network+ CompTIA Security+ CiscoCyberOpsAssociate Microsoft SC-200 Security Operations Analyst Microsoft SC-300 Identity and Access Administrator Additional Cisco security or networking certifications preferred This job description is intended to provide a general overview of the position. It is not intended to be an exhaustive list of all responsibilities, duties, and skills required. The company reserves the right to modify or change the job description at any time.
VIRGINIA FARM BUREAU MUTUAL INSURANCE CO
Richmond, Virginia
Job Description Job Description POSITION TITLE: Junior Security Specialist- Incident Response STATUS: Exempt COMPENSATION RANGE: $74,000 - $79,000 Annually LOCATION: Based out of our beautiful West Creek Office, located at 12580 West Creek Pkwy, Richmond, VA 23238. Hybrid schedule is offered, in office 2 days a week, work from home 3 days a week, after training and probationary period is completed. No relocation offered. REPORTS TO: Head of Active Defense POSITION SUMMARY: The Junior Security Specialist will support the Information Security Section in maintaining and improving the organization's security posture. This role assists with basic incident response coordination, vulnerability scanning, and system monitoring and system analyst duties. The individual will work closely with senior team members to learn and apply security best practices, contribute to ongoing security projects, and help ensure the confidentiality, integrity, and availability of organizational systems. This is a growth-oriented position ideal for candidates with foundational cybersecurity knowledge and a desire to advance their skills in incident response, vulnerability and exposure management, threat detection, and security operations. PRIMARY DUTIES: Support incident response efforts by gathering data and assisting with ticket triage. Assist with system event triage, non-conformance tracking, and other response actions as needed Assist in performing internal and external vulnerability scans and documenting findings. Support the remediation of identified vulnerabilities by coordinating with system owners and IT staff. Monitor security tools and alerts, escalating issues to senior team members as needed. Participate in security awareness activities, including phishing simulations and training coordination. Help maintain documentation for security policies, procedures, and standards. Collaborate with IT and compliance teams to support risk management and regulatory requirements. Stay informed on basic cybersecurity trends and threats through training and research. ADDITIONAL DUTIES: Assist with account access reviews and basic IAM tasks. Support endpoint protection efforts, including monitoring and updating security software. Participate in tabletop exercises and team training sessions. Help document un-remediated vulnerabilities in the risk registry under guidance. Perform other information security and cybersecurity duties as directed MINIMUM EDUCATIONAL/EXPERIENCE QUALIFICATIONS: 1-3 years of experience in IT or cybersecurity-related roles. Associate's or Bachelor's degree in cybersecurity, information technology, or a related field. Entry-level certification preferred (e.g., CompTIA Security+, GIAC GSEC, Microsoft SC-900). Basic understanding of network devices, operating systems, and security principles. Strong desire to learn and grow in the cybersecurity field. MINIMUM SKILL QUALIFICATIONS: Familiarity with pentesting tools, methodologies, & Incident Response lifecycle. Familiarity with vulnerability scanning tools and basic remediation processes. Understanding of network and endpoint security fundamentals. Ability to follow procedures and document work clearly. Strong communication and teamwork skills. Analytical thinking and attention to detail. PREFERRED QUALIFICATIONS: Exposure to tools such as SIEM, EDR, IAM, or MDR platforms. Familiarity with NIST, CIS, or ISO security frameworks. Experience with cloud environments and mobile device management. Hands-on experience with basic troubleshooting and system monitoring. At VA Farm Bureau, we provide an exceptional benefits package, including ongoing job development and support in all roles, paid training and continuing education reimbursement, medical and dental insurance available on your first day, generous employee 401K contribution, excellent Paid Time off (PTO) plan and more! Virginia Farm Bureau Companies provide equal employment opportunity in all aspects of employment without regard to race, color, national origin, religion, gender, pregnancy, age, disability, orientation or veteran status.
11/06/2026
Full time
Job Description Job Description POSITION TITLE: Junior Security Specialist- Incident Response STATUS: Exempt COMPENSATION RANGE: $74,000 - $79,000 Annually LOCATION: Based out of our beautiful West Creek Office, located at 12580 West Creek Pkwy, Richmond, VA 23238. Hybrid schedule is offered, in office 2 days a week, work from home 3 days a week, after training and probationary period is completed. No relocation offered. REPORTS TO: Head of Active Defense POSITION SUMMARY: The Junior Security Specialist will support the Information Security Section in maintaining and improving the organization's security posture. This role assists with basic incident response coordination, vulnerability scanning, and system monitoring and system analyst duties. The individual will work closely with senior team members to learn and apply security best practices, contribute to ongoing security projects, and help ensure the confidentiality, integrity, and availability of organizational systems. This is a growth-oriented position ideal for candidates with foundational cybersecurity knowledge and a desire to advance their skills in incident response, vulnerability and exposure management, threat detection, and security operations. PRIMARY DUTIES: Support incident response efforts by gathering data and assisting with ticket triage. Assist with system event triage, non-conformance tracking, and other response actions as needed Assist in performing internal and external vulnerability scans and documenting findings. Support the remediation of identified vulnerabilities by coordinating with system owners and IT staff. Monitor security tools and alerts, escalating issues to senior team members as needed. Participate in security awareness activities, including phishing simulations and training coordination. Help maintain documentation for security policies, procedures, and standards. Collaborate with IT and compliance teams to support risk management and regulatory requirements. Stay informed on basic cybersecurity trends and threats through training and research. ADDITIONAL DUTIES: Assist with account access reviews and basic IAM tasks. Support endpoint protection efforts, including monitoring and updating security software. Participate in tabletop exercises and team training sessions. Help document un-remediated vulnerabilities in the risk registry under guidance. Perform other information security and cybersecurity duties as directed MINIMUM EDUCATIONAL/EXPERIENCE QUALIFICATIONS: 1-3 years of experience in IT or cybersecurity-related roles. Associate's or Bachelor's degree in cybersecurity, information technology, or a related field. Entry-level certification preferred (e.g., CompTIA Security+, GIAC GSEC, Microsoft SC-900). Basic understanding of network devices, operating systems, and security principles. Strong desire to learn and grow in the cybersecurity field. MINIMUM SKILL QUALIFICATIONS: Familiarity with pentesting tools, methodologies, & Incident Response lifecycle. Familiarity with vulnerability scanning tools and basic remediation processes. Understanding of network and endpoint security fundamentals. Ability to follow procedures and document work clearly. Strong communication and teamwork skills. Analytical thinking and attention to detail. PREFERRED QUALIFICATIONS: Exposure to tools such as SIEM, EDR, IAM, or MDR platforms. Familiarity with NIST, CIS, or ISO security frameworks. Experience with cloud environments and mobile device management. Hands-on experience with basic troubleshooting and system monitoring. At VA Farm Bureau, we provide an exceptional benefits package, including ongoing job development and support in all roles, paid training and continuing education reimbursement, medical and dental insurance available on your first day, generous employee 401K contribution, excellent Paid Time off (PTO) plan and more! Virginia Farm Bureau Companies provide equal employment opportunity in all aspects of employment without regard to race, color, national origin, religion, gender, pregnancy, age, disability, orientation or veteran status.
Job Description Job Description Boarhog LLC has an immediate opening for a junior-level Information Systems Security Specialist (Level I) in support of delivering engineering services predominantly for the U.S. Navy's AEGIS Weapon System and AEGIS Combat System designs for the AEGIS Technical Representative (TechRep) who manages the Government-owned Vice Admiral James H. Doyle, Jr., Combat System Engineering Development Site (CSEDS) located in Moorestown, New Jersey. Security Specialists provide security risk management guidance pertaining to the protection of advanced technologies, make access eligibility determinations in accordance with the Navy SAP Nomination Process, and review documentation required for classified information systems in accordance with the current regulations. They may also conduct site surveys and physical security accreditations, interpret current security policies, and implement organization security policies and procedures. EXPERIENCE : Minimum three (3) years' Cybersecurity experience in Systems Development and Test & Evaluation. Working level familiarity with Trellix , the cybersecurity software suite that supports analysts in demonstrating and improving their performance. Working level familiarity with ForeScout to identify, monitor, control, and secure the devices on networks. Working level familiarity with the Assured Compliance Assessment Solution ( ACAS ) to provide automated vulnerability scanning, configuration assessment, and compliance reporting across networks. Working level familiarity with the Security Information and Event Management (SIEM) and data analytics platform Splunk to turn raw log data into real-time visibility, threat detection, and incident response. Working knowledge of security classification methods, concepts, eligibility for access to classified or sensitive information and the process for granting personnel security clearances/accesses Working knowledge of commonly applied security principles, concepts, and methodologies in carrying out information, personnel, and physical security programs related to the protection of SCI. Knowledge of conducting inspections and investigations, collecting and analyzing information, etc., and skill in weighing the impact of variables such as critical personnel qualifications, variations in building construction characteristics, access and entry restrictions, equipment availability, and other issues that influence the course of actions taken in resolving security questions and issues. QUALIFICATIONS : Either an advanced/master-level vendor Cyber-related certification (e.g., CISSP, CISM, GSLC, or CASP), or a bachelor-level degree from an accredited university in a Specialty Area Code/Work Role Code-related field or a minimum of three (3) years of experience in-depth specialized knowledge in the related field and a CompTIA Security+ certification Must currently possess and maintain or be able to obtain and maintain an adjudicated Tier Five/Single Scope Background Investigation. BENEFITS : Boarhog has over 13 years of defense industrial base steady, controlled growth and profitability, offering our full-time associates a remarkable compensation package, including: A competitive salary and opportunities for additional compensation working special projects 100% coverage of medical/ dental/ vision health premiums. Company 401K contribution. Paid vacation. Health savings account. Greater Self-Determination Stipend for residing in a HUBZone location (). Relocation or small signing bonus, and earned performance bonus. We thrive in a welcoming culture within a completely flat organization (and we mean flat there is no organization chart. No Presidents, VPs, etc populating an industrial age pyramid); with flat promoting self-determination. Associates work directly for the Managing Member who is also the owner and co-founder. There is no fat on the Boarhog nobody has ever and will ever make a living watching other associates do work. We have a vested interest in our associates' personal and professional goals and aspirations, communicated by each of the three dozen associates in five states directly with the Managing Member, who retired from active duty after 21 years as an unrestricted line Surface Warfare Officer and Department of the Navy Acquisition Professional, with 10 years in the defense industry supporting U.S. Navy contracts before starting Boarhog 13 years ago. He actively engages in day-to-day operations, to include recruiting and hiring, and also periodically performs direct on government and commercial contracts. We take pride in the resulting exceedingly low associate turnover rate and family atmosphere. Pigs in the breakfast with skin-in-the-game is the story behind our logo. Maybe you have what it takes to join us! E04JI800rmcl407o7za
11/06/2026
Full time
Job Description Job Description Boarhog LLC has an immediate opening for a junior-level Information Systems Security Specialist (Level I) in support of delivering engineering services predominantly for the U.S. Navy's AEGIS Weapon System and AEGIS Combat System designs for the AEGIS Technical Representative (TechRep) who manages the Government-owned Vice Admiral James H. Doyle, Jr., Combat System Engineering Development Site (CSEDS) located in Moorestown, New Jersey. Security Specialists provide security risk management guidance pertaining to the protection of advanced technologies, make access eligibility determinations in accordance with the Navy SAP Nomination Process, and review documentation required for classified information systems in accordance with the current regulations. They may also conduct site surveys and physical security accreditations, interpret current security policies, and implement organization security policies and procedures. EXPERIENCE : Minimum three (3) years' Cybersecurity experience in Systems Development and Test & Evaluation. Working level familiarity with Trellix , the cybersecurity software suite that supports analysts in demonstrating and improving their performance. Working level familiarity with ForeScout to identify, monitor, control, and secure the devices on networks. Working level familiarity with the Assured Compliance Assessment Solution ( ACAS ) to provide automated vulnerability scanning, configuration assessment, and compliance reporting across networks. Working level familiarity with the Security Information and Event Management (SIEM) and data analytics platform Splunk to turn raw log data into real-time visibility, threat detection, and incident response. Working knowledge of security classification methods, concepts, eligibility for access to classified or sensitive information and the process for granting personnel security clearances/accesses Working knowledge of commonly applied security principles, concepts, and methodologies in carrying out information, personnel, and physical security programs related to the protection of SCI. Knowledge of conducting inspections and investigations, collecting and analyzing information, etc., and skill in weighing the impact of variables such as critical personnel qualifications, variations in building construction characteristics, access and entry restrictions, equipment availability, and other issues that influence the course of actions taken in resolving security questions and issues. QUALIFICATIONS : Either an advanced/master-level vendor Cyber-related certification (e.g., CISSP, CISM, GSLC, or CASP), or a bachelor-level degree from an accredited university in a Specialty Area Code/Work Role Code-related field or a minimum of three (3) years of experience in-depth specialized knowledge in the related field and a CompTIA Security+ certification Must currently possess and maintain or be able to obtain and maintain an adjudicated Tier Five/Single Scope Background Investigation. BENEFITS : Boarhog has over 13 years of defense industrial base steady, controlled growth and profitability, offering our full-time associates a remarkable compensation package, including: A competitive salary and opportunities for additional compensation working special projects 100% coverage of medical/ dental/ vision health premiums. Company 401K contribution. Paid vacation. Health savings account. Greater Self-Determination Stipend for residing in a HUBZone location (). Relocation or small signing bonus, and earned performance bonus. We thrive in a welcoming culture within a completely flat organization (and we mean flat there is no organization chart. No Presidents, VPs, etc populating an industrial age pyramid); with flat promoting self-determination. Associates work directly for the Managing Member who is also the owner and co-founder. There is no fat on the Boarhog nobody has ever and will ever make a living watching other associates do work. We have a vested interest in our associates' personal and professional goals and aspirations, communicated by each of the three dozen associates in five states directly with the Managing Member, who retired from active duty after 21 years as an unrestricted line Surface Warfare Officer and Department of the Navy Acquisition Professional, with 10 years in the defense industry supporting U.S. Navy contracts before starting Boarhog 13 years ago. He actively engages in day-to-day operations, to include recruiting and hiring, and also periodically performs direct on government and commercial contracts. We take pride in the resulting exceedingly low associate turnover rate and family atmosphere. Pigs in the breakfast with skin-in-the-game is the story behind our logo. Maybe you have what it takes to join us! E04JI800rmcl407o7za
Job Description Job Description Title: Subject Matter Expert II Description: Solutions LLC is supporting a U.S. Government customer to support for onsite incident response to civilian Government agencies and critical asset owners who experience cyber-attacks, providing immediate investigation and resolution. Contract personnel perform investigations to characterize the severity of breaches, develop mitigation plans, and assist with the restoration of services. Solutions LLC is seeking an experienced and technically proficient Subject Matter Expert (SME) Hardware Reverse Engineer to provide specialized expertise in hardware reverse engineering focused on operational technology (OT) and industrial control systems. This position requires deep technical knowledge of proprietary hardware systems, exploitation methodologies, and defensive strategies to support forensic investigations of compromised edge devices and systems where threat actors have embedded malware deeply within hardware components. This position focuses on the analytical and investigative aspects of hardware forensics, with particular emphasis on operational technology and industrial control systems. The ideal candidates will have strong reverse engineering skills and deep understanding of threat actor methodologies targeting critical infrastructure. Eligibility: Must be a US Citizen Must have an active Secret clearance with the ability to obtain a TS/SCI Must be able to obtain DHS Suitability prior to starting employment 10+ years of experience in hardware reverse engineering or embedded systems analysis Responsibilities Include: Conduct comprehensive hardware reverse engineering of OT and ICS devices Analyze network-edge devices and embedded systems compromised by advanced threats Perform deep-dive analysis of proprietary hardware targeted by adversaries Conduct reverse engineering, failure analysis, vulnerability analysis, and other research techniques to understand complex hardware systems, assess the functionality of components, and identify exploitation risks Identify and extract deeply embedded malware from hardware components Reverse engineer firmware and low-level software on embedded devices Collaborate with Solutions LLC research teams to leverage cutting-edge analytical capabilities Utilize and enhance KI2 system emulation capabilities for hardware analysis Document exploitation methodologies and defensive countermeasures Develop standard operating procedures for hardware forensics workflows Train CSD analysts on hardware reverse engineering techniques Provide expert consultation on edge device security and vulnerabilities Support forensic investigations in environments lacking EDR visibility Analyze proprietary communication protocols and embedded systems functions Identify hardware backdoors, implants, and malicious modifications Collaborate with electrical engineers on chip-off forensics procedures Provide reach-back support to operational analysts during active investigations Contribute to research initiatives on emerging hardware threats Document technical findings and intelligence for stakeholder dissemination Required Skills: Deep expertise in OT/ICS hardware platforms and vulnerabilities Ability to analyze novel or proprietary systems with limited documentation Strong communication skills for explaining complex technical findings Experience working collaboratively in research-oriented environments Strong experience with firmware reverse engineering and analysis Proficiency with reverse engineering tools (IDA Pro, Ghidra, Binary Ninja) Deep understanding of ARM, MIPS, PowerPC, and other embedded processor architectures Experience analyzing network-edge devices (routers, switches, firewalls, IoT devices) Knowledge of hardware debugging interfaces (JTAG, SWD, UART) Strong programming and scripting skills (Python, C, Assembly) Understanding of exploitation techniques targeting embedded systems Experience with malware analysis in hardware/firmware contexts Excellent analytical and problem-solving abilities Desired Skills: Experience supporting federal cybersecurity or critical infrastructure protection programs Experience performing inspection, imaging, decapsulation, deprocessing, and other activities related to hardware reverse engineering and exploitation in a state-of-the-art microelectronics exploitation laboratory Background in offensive security or penetration testing of OT environments Advanced certifications in reverse engineering (GREM, GXPN, or similar) Experience with SCADA, PLC, RTU, and other industrial control components Knowledge of critical infrastructure sector technologies (energy, utilities, manufacturing) Familiarity with supply chain security and hardware implant detection Experience with system emulation platforms and virtual hardware analysis Understanding of threat actor TTPs targeting OT and edge devices Background in electronics manufacturing or hardware security research Experience with chip decapsulation and invasive hardware analysis techniques Desired Certifications: DoD 8140 IAT Level III
11/06/2026
Full time
Job Description Job Description Title: Subject Matter Expert II Description: Solutions LLC is supporting a U.S. Government customer to support for onsite incident response to civilian Government agencies and critical asset owners who experience cyber-attacks, providing immediate investigation and resolution. Contract personnel perform investigations to characterize the severity of breaches, develop mitigation plans, and assist with the restoration of services. Solutions LLC is seeking an experienced and technically proficient Subject Matter Expert (SME) Hardware Reverse Engineer to provide specialized expertise in hardware reverse engineering focused on operational technology (OT) and industrial control systems. This position requires deep technical knowledge of proprietary hardware systems, exploitation methodologies, and defensive strategies to support forensic investigations of compromised edge devices and systems where threat actors have embedded malware deeply within hardware components. This position focuses on the analytical and investigative aspects of hardware forensics, with particular emphasis on operational technology and industrial control systems. The ideal candidates will have strong reverse engineering skills and deep understanding of threat actor methodologies targeting critical infrastructure. Eligibility: Must be a US Citizen Must have an active Secret clearance with the ability to obtain a TS/SCI Must be able to obtain DHS Suitability prior to starting employment 10+ years of experience in hardware reverse engineering or embedded systems analysis Responsibilities Include: Conduct comprehensive hardware reverse engineering of OT and ICS devices Analyze network-edge devices and embedded systems compromised by advanced threats Perform deep-dive analysis of proprietary hardware targeted by adversaries Conduct reverse engineering, failure analysis, vulnerability analysis, and other research techniques to understand complex hardware systems, assess the functionality of components, and identify exploitation risks Identify and extract deeply embedded malware from hardware components Reverse engineer firmware and low-level software on embedded devices Collaborate with Solutions LLC research teams to leverage cutting-edge analytical capabilities Utilize and enhance KI2 system emulation capabilities for hardware analysis Document exploitation methodologies and defensive countermeasures Develop standard operating procedures for hardware forensics workflows Train CSD analysts on hardware reverse engineering techniques Provide expert consultation on edge device security and vulnerabilities Support forensic investigations in environments lacking EDR visibility Analyze proprietary communication protocols and embedded systems functions Identify hardware backdoors, implants, and malicious modifications Collaborate with electrical engineers on chip-off forensics procedures Provide reach-back support to operational analysts during active investigations Contribute to research initiatives on emerging hardware threats Document technical findings and intelligence for stakeholder dissemination Required Skills: Deep expertise in OT/ICS hardware platforms and vulnerabilities Ability to analyze novel or proprietary systems with limited documentation Strong communication skills for explaining complex technical findings Experience working collaboratively in research-oriented environments Strong experience with firmware reverse engineering and analysis Proficiency with reverse engineering tools (IDA Pro, Ghidra, Binary Ninja) Deep understanding of ARM, MIPS, PowerPC, and other embedded processor architectures Experience analyzing network-edge devices (routers, switches, firewalls, IoT devices) Knowledge of hardware debugging interfaces (JTAG, SWD, UART) Strong programming and scripting skills (Python, C, Assembly) Understanding of exploitation techniques targeting embedded systems Experience with malware analysis in hardware/firmware contexts Excellent analytical and problem-solving abilities Desired Skills: Experience supporting federal cybersecurity or critical infrastructure protection programs Experience performing inspection, imaging, decapsulation, deprocessing, and other activities related to hardware reverse engineering and exploitation in a state-of-the-art microelectronics exploitation laboratory Background in offensive security or penetration testing of OT environments Advanced certifications in reverse engineering (GREM, GXPN, or similar) Experience with SCADA, PLC, RTU, and other industrial control components Knowledge of critical infrastructure sector technologies (energy, utilities, manufacturing) Familiarity with supply chain security and hardware implant detection Experience with system emulation platforms and virtual hardware analysis Understanding of threat actor TTPs targeting OT and edge devices Background in electronics manufacturing or hardware security research Experience with chip decapsulation and invasive hardware analysis techniques Desired Certifications: DoD 8140 IAT Level III
Job Description Job Description BCMC is supporting a U.S. Government customer to provide support for onsite incident response to civilian Government agencies and critical asset owners who experience cyber-attacks, providing immediate investigation and resolution. Contract personnel perform investigations to characterize the severity of breaches, develop mitigation plans, and assist with the restoration of services. BCMC is seeking a Subject Matter Expert with hardware reverse engineering to support this critical customer mission. The Subject Matter Expert Hardware Reverse Engineers will provide specialized expertise in hardware reverse engineering focused on operational technology (OT) and industrial control systems. This position requires deep technical knowledge of proprietary hardware systems, exploitation methodologies, and defensive strategies to support forensic investigations of compromised edge devices and systems where threat actors have embedded malware deeply within hardware components. This position focuses on the analytical and investigative aspects of hardware forensics, with particular emphasis on operational technology and industrial control systems. The ideal candidates will have strong reverse engineering skills and deep understanding of threat actor methodologies targeting critical infrastructure. Responsibilities: - Conduct comprehensive hardware reverse engineering of OT and ICS devices - Analyze network-edge devices and embedded systems compromised by advanced threats - Perform deep-dive analysis of proprietary hardware targeted by adversaries - Conduct reverse engineering, failure analysis, vulnerability analysis, and other research techniques to understand complex hardware systems, assess the functionality of components, and identify exploitation risks - Identify and extract deeply embedded malware from hardware components - Reverse engineer firmware and low-level software on embedded devices - Collaborate with research teams to leverage cutting-edge analytical capabilities - Utilize and enhance KI2 system emulation capabilities for hardware analysis - Document exploitation methodologies and defensive countermeasures - Develop standard operating procedures for hardware forensics workflows - Train CSD analysts on hardware reverse engineering techniques - Provide expert consultation on edge device security and vulnerabilities - Support forensic investigations in environments lacking EDR visibility - Analyze proprietary communication protocols and embedded systems functions - Identify hardware backdoors, implants, and malicious modifications - Collaborate with electrical engineers on chip-off forensics procedures - Provide reach-back support to operational analysts during active investigations - Contribute to research initiatives on emerging hardware threats - Document technical findings and intelligence for stakeholder dissemination Required Skills: - U.S. Citizenship - Must have an active TS/SCI clearance - Must be able to obtain DHS Suitability - 10+ years of experience in hardware reverse engineering or embedded systems analysis - Deep expertise in OT/ICS hardware platforms and vulnerabilities - Ability to analyze novel or proprietary systems with limited documentation - Strong communication skills for explaining complex technical findings - Experience working collaboratively in research-oriented environments - Strong experience with firmware reverse engineering and analysis - Proficiency with reverse engineering tools (IDA Pro, Ghidra, Binary Ninja) - Deep understanding of ARM, MIPS, PowerPC, and other embedded processor architectures - Experience analyzing network-edge devices (routers, switches, firewalls, IoT devices) - Knowledge of hardware debugging interfaces (JTAG, SWD, UART) - Strong programming and scripting skills (Python, C, Assembly) - Understanding of exploitation techniques targeting embedded systems - Experience with malware analysis in hardware/firmware contexts - Excellent analytical and problem-solving abilities Desired Skills: - Experience supporting federal cybersecurity or critical infrastructure protection programs - Experience performing inspection, imaging, decapsulation, deprocessing, and other activities related to hardware reverse engineering and exploitation in a state-of-the-art microelectronics exploitation laboratory - Background in offensive security or penetration testing of OT environments - Advanced certifications in reverse engineering (GREM, GXPN, or similar) - Experience with SCADA, PLC, RTU, and other industrial control components - Knowledge of critical infrastructure sector technologies (energy, utilities, manufacturing) - Familiarity with supply chain security and hardware implant detection - Experience with system emulation platforms and virtual hardware analysis - Understanding of threat actor TTPs targeting OT and edge devices - Background in electronics manufacturing or hardware security research - Experience with chip decapsulation and invasive hardware analysis techniques Required Education: Bachelor's degree in Electrical Engineering, Computer Engineering or related discipline; Master's degree or PhD preferred Desired Certifications: - DoD 8140.01 IAT Level III - PMP Our Company Overview Business Computers Management Consulting Group, LLC (BCMC) is a small business specializing in Information Technology (IT), Cybersecurity, Information Assurance (IA), SOA, Big Data Management, Program Management, and more for Federal, State, and Local agencies. We possess highly skilled engineers, providing innovative solutions backed by strong past performances. We are ISO 9001:2015, ISO 27001:2013, 20000:2018, and CMMI L3 certified and registered promising highest quality and services to all of our clients. Benefits Extremely competitive salary 95% employer paid for employee medical, dental, & vision coverages 100% employer paid for employee life, STD & LTD disability coverages 401k with company match and profit sharing Flexible Spending Account (FSA) for dependent & health care 11 standard holidays & 3 weeks of annual leave ESS-3418 ESS-3417 Subject Matter Expert II - SME02 Powered by JazzHR z8ZBtpjvL4
11/06/2026
Full time
Job Description Job Description BCMC is supporting a U.S. Government customer to provide support for onsite incident response to civilian Government agencies and critical asset owners who experience cyber-attacks, providing immediate investigation and resolution. Contract personnel perform investigations to characterize the severity of breaches, develop mitigation plans, and assist with the restoration of services. BCMC is seeking a Subject Matter Expert with hardware reverse engineering to support this critical customer mission. The Subject Matter Expert Hardware Reverse Engineers will provide specialized expertise in hardware reverse engineering focused on operational technology (OT) and industrial control systems. This position requires deep technical knowledge of proprietary hardware systems, exploitation methodologies, and defensive strategies to support forensic investigations of compromised edge devices and systems where threat actors have embedded malware deeply within hardware components. This position focuses on the analytical and investigative aspects of hardware forensics, with particular emphasis on operational technology and industrial control systems. The ideal candidates will have strong reverse engineering skills and deep understanding of threat actor methodologies targeting critical infrastructure. Responsibilities: - Conduct comprehensive hardware reverse engineering of OT and ICS devices - Analyze network-edge devices and embedded systems compromised by advanced threats - Perform deep-dive analysis of proprietary hardware targeted by adversaries - Conduct reverse engineering, failure analysis, vulnerability analysis, and other research techniques to understand complex hardware systems, assess the functionality of components, and identify exploitation risks - Identify and extract deeply embedded malware from hardware components - Reverse engineer firmware and low-level software on embedded devices - Collaborate with research teams to leverage cutting-edge analytical capabilities - Utilize and enhance KI2 system emulation capabilities for hardware analysis - Document exploitation methodologies and defensive countermeasures - Develop standard operating procedures for hardware forensics workflows - Train CSD analysts on hardware reverse engineering techniques - Provide expert consultation on edge device security and vulnerabilities - Support forensic investigations in environments lacking EDR visibility - Analyze proprietary communication protocols and embedded systems functions - Identify hardware backdoors, implants, and malicious modifications - Collaborate with electrical engineers on chip-off forensics procedures - Provide reach-back support to operational analysts during active investigations - Contribute to research initiatives on emerging hardware threats - Document technical findings and intelligence for stakeholder dissemination Required Skills: - U.S. Citizenship - Must have an active TS/SCI clearance - Must be able to obtain DHS Suitability - 10+ years of experience in hardware reverse engineering or embedded systems analysis - Deep expertise in OT/ICS hardware platforms and vulnerabilities - Ability to analyze novel or proprietary systems with limited documentation - Strong communication skills for explaining complex technical findings - Experience working collaboratively in research-oriented environments - Strong experience with firmware reverse engineering and analysis - Proficiency with reverse engineering tools (IDA Pro, Ghidra, Binary Ninja) - Deep understanding of ARM, MIPS, PowerPC, and other embedded processor architectures - Experience analyzing network-edge devices (routers, switches, firewalls, IoT devices) - Knowledge of hardware debugging interfaces (JTAG, SWD, UART) - Strong programming and scripting skills (Python, C, Assembly) - Understanding of exploitation techniques targeting embedded systems - Experience with malware analysis in hardware/firmware contexts - Excellent analytical and problem-solving abilities Desired Skills: - Experience supporting federal cybersecurity or critical infrastructure protection programs - Experience performing inspection, imaging, decapsulation, deprocessing, and other activities related to hardware reverse engineering and exploitation in a state-of-the-art microelectronics exploitation laboratory - Background in offensive security or penetration testing of OT environments - Advanced certifications in reverse engineering (GREM, GXPN, or similar) - Experience with SCADA, PLC, RTU, and other industrial control components - Knowledge of critical infrastructure sector technologies (energy, utilities, manufacturing) - Familiarity with supply chain security and hardware implant detection - Experience with system emulation platforms and virtual hardware analysis - Understanding of threat actor TTPs targeting OT and edge devices - Background in electronics manufacturing or hardware security research - Experience with chip decapsulation and invasive hardware analysis techniques Required Education: Bachelor's degree in Electrical Engineering, Computer Engineering or related discipline; Master's degree or PhD preferred Desired Certifications: - DoD 8140.01 IAT Level III - PMP Our Company Overview Business Computers Management Consulting Group, LLC (BCMC) is a small business specializing in Information Technology (IT), Cybersecurity, Information Assurance (IA), SOA, Big Data Management, Program Management, and more for Federal, State, and Local agencies. We possess highly skilled engineers, providing innovative solutions backed by strong past performances. We are ISO 9001:2015, ISO 27001:2013, 20000:2018, and CMMI L3 certified and registered promising highest quality and services to all of our clients. Benefits Extremely competitive salary 95% employer paid for employee medical, dental, & vision coverages 100% employer paid for employee life, STD & LTD disability coverages 401k with company match and profit sharing Flexible Spending Account (FSA) for dependent & health care 11 standard holidays & 3 weeks of annual leave ESS-3418 ESS-3417 Subject Matter Expert II - SME02 Powered by JazzHR z8ZBtpjvL4
Job Description Job Description About Agile Defense At Agile Defense we know that action defines the outcome and new challenges require new solutions. That's why we always look to the future and embrace change with an unmovable spirit and the courage to build for what comes next. Our vision is to bring adaptive innovation to support our nation's most important missions through the seamless integration of advanced technologies, elite minds, and unparalleled agility-leveraging a foundation of speed, flexibility, and ingenuity to strengthen and protect our nation's vital interests. Title : Insider Threat Monitoring Lead (CBP) Clearance : Active Top Secret with SCI Eligibility, and ability to obtain CBP Background Investigation (CBP BI) and EOD, active BI strongly preferred. We can begin processing for candidates who do not hold one. Citizenship : U.S. Citizenship required Location : Reston, VA - Hybrid, 3-5 days onsite Salary Range : $160,000-$185,000 Signing Bonus : $10,000 for candidates with an active CBP BI. Payable after 90 days; standard terms apply. Travel : Rare, as needed Required Certification(s) : Active CISSP The Role U.S. Customs and Border Protection runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. The systems behind that mission hold sensitive law enforcement and personal data, and the people with legitimate access to it are, by definition, trusted. Most of the damage an insider threat program exists to catch does not come from a sophisticated outside attacker. It comes from someone who already has the access, and the work is telling the difference between normal use and misuse without treating every employee as a suspect. You lead that function. You will build and run the monitoring, analysis, and escalation process that catches insider risk early, working closely with the Security Operations Center Manager, human resources and security partners, and the incident response and digital forensics leads when a case moves from monitoring to action. One thing is worth knowing before you apply. This work carries real privacy and proportionality weight. Getting it wrong in either direction, missing real risk or treating ordinary behavior as suspicious, costs the program trust it needs to keep doing the job. What Success Looks Like Objective 1: Catch real insider risk without drowning in noise Cases that escalate to investigation are the ones that warrant it, not everything that triggered an alert. Patterns that matter, unusual access, data movement, or behavior change, get identified before they become an incident rather than after. Analysts working under you can explain why a case escalated in terms someone outside the program would find reasonable. Objective 2: Run the program in a way people can trust is fair Monitoring stays proportional to actual risk indicators rather than expanding because it is easy to collect more data. Cases get handled consistently regardless of who the subject is. When a case does not substantiate, it closes cleanly rather than leaving a lingering question mark on someone's record. Objective 3: Hand off cleanly when a case becomes something else Cases that move to investigation or incident response arrive with a record that the next team can act on immediately, not one they have to reconstruct. You know where insider threat monitoring's job ends and where forensics or HR involvement begins, and you do not sit on a case past that line. Findings that reveal a systemic gap, not just an individual case, reach the people who can fix the gap. Objective 4: Improve what the program watches for over time Detection logic gets tuned based on what real cases actually looked like, not left static after initial setup. Near misses and lessons learned change what the program monitors going forward. You can explain the program's current blind spots honestly, rather than presenting coverage as complete. What You Bring Minimum Required Experience Minimum of five (5) years of professional experience leading the cyber component of an insider threat program An in-depth understanding of the principles, methodologies, and best practices for establishing, operating, and maturing an insider threat program. Active Certified Information Systems Security Professional (CISSP) Bachelor's degree in computer science, Engineering, STEM, Information Technology, or Cybersecurity Preferred Experience You have run or been a senior analyst in an insider threat program, ideally in a federal or cleared environment where NITTF-aligned or equivalent standards applied. You have handled a case that involved coordination with HR, legal, or security partners, and can describe how you kept it proportional. You have tuned detection logic based on real case outcomes rather than left it as originally configured. You can explain a sensitive finding to people outside the program in terms they can act on without oversharing what they should not see. You hold an active CBP BI, a fitness determination at another DHS component, or an active DoD clearance. Any of these shortens your start date. You are comfortable working closely with human behavior data and understand the privacy and legal boundaries around it, not only the technical monitoring tools. Counter-intelligence experience Digital Forensics and related certifications User Activity Monitoring (UAM) User Behavior Analytics (UBA) A note on timing We are staffing this program now. If you already hold an active CBP BI and EOD, your start date is short and a $10,000 signing bonus comes with the role, payable after 90 days under standard terms. We would like to talk this week. If you do not, we can begin processing a CBP BI for you. That takes months rather than weeks, so applying now means joining a pipeline rather than starting immediately. We would rather tell you that up front than have you find out after you apply. Employee Benefits Agile's benefits offerings include, dependent upon position, Health Insurance, Life Insurance, Paid Time Off, Holiday Pay, short-term and long-term Disability, Retirement and Learning and Development opportunities as well as other optional benefit elections. Our Core Values Employees of Agile Defense are our number one priority, and the importance we place on our culture here is fundamental. Our culture is alive and evolving, but it always stays true to its roots. Here, you are valued as a family member, and we believe that we can accomplish great things together. Agile Defense has been highly successful in the past few years due to our employees and the culture we create together. What makes us Agile? We call it the 6Hs, the values that define our culture and guide everything we do. Together, these values infuse vibrancy, integrity, and a tireless work ethic into advancing the most important national security and critical civilian missions. It's how we show up every day. It's who we are. Happy - Be Infectious. Happiness multiplies and creates a positive and connected environment where motivation and satisfaction have an outsized effect on everything we do. Helpful - Be Supportive. Being helpful is the foundation of teamwork, resulting in a supportive atmosphere where collaboration flourishes, and collective success is celebrated. Honest - Be Trustworthy. Honesty serves as our compass, ensuring transparent communication and ethical conduct, essential to who we are and the complex domains we support. Humble - Be Grounded. Success is not achieved alone, humility ensures a culture of mutual respect, encouraging open communication, and a willingness to learn from one another and take on any task. Hungry - Be Eager. Our hunger for excellence drives an insatiable appetite for innovation and continuous improvement, propelling us forward in the face of new and unprecedented challenges. Hustle - Be Driven. Hustle is reflected in our relentless work ethic, where we are each committed to going above and beyond to advance the mission and achieve success. Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.
11/06/2026
Full time
Job Description Job Description About Agile Defense At Agile Defense we know that action defines the outcome and new challenges require new solutions. That's why we always look to the future and embrace change with an unmovable spirit and the courage to build for what comes next. Our vision is to bring adaptive innovation to support our nation's most important missions through the seamless integration of advanced technologies, elite minds, and unparalleled agility-leveraging a foundation of speed, flexibility, and ingenuity to strengthen and protect our nation's vital interests. Title : Insider Threat Monitoring Lead (CBP) Clearance : Active Top Secret with SCI Eligibility, and ability to obtain CBP Background Investigation (CBP BI) and EOD, active BI strongly preferred. We can begin processing for candidates who do not hold one. Citizenship : U.S. Citizenship required Location : Reston, VA - Hybrid, 3-5 days onsite Salary Range : $160,000-$185,000 Signing Bonus : $10,000 for candidates with an active CBP BI. Payable after 90 days; standard terms apply. Travel : Rare, as needed Required Certification(s) : Active CISSP The Role U.S. Customs and Border Protection runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. The systems behind that mission hold sensitive law enforcement and personal data, and the people with legitimate access to it are, by definition, trusted. Most of the damage an insider threat program exists to catch does not come from a sophisticated outside attacker. It comes from someone who already has the access, and the work is telling the difference between normal use and misuse without treating every employee as a suspect. You lead that function. You will build and run the monitoring, analysis, and escalation process that catches insider risk early, working closely with the Security Operations Center Manager, human resources and security partners, and the incident response and digital forensics leads when a case moves from monitoring to action. One thing is worth knowing before you apply. This work carries real privacy and proportionality weight. Getting it wrong in either direction, missing real risk or treating ordinary behavior as suspicious, costs the program trust it needs to keep doing the job. What Success Looks Like Objective 1: Catch real insider risk without drowning in noise Cases that escalate to investigation are the ones that warrant it, not everything that triggered an alert. Patterns that matter, unusual access, data movement, or behavior change, get identified before they become an incident rather than after. Analysts working under you can explain why a case escalated in terms someone outside the program would find reasonable. Objective 2: Run the program in a way people can trust is fair Monitoring stays proportional to actual risk indicators rather than expanding because it is easy to collect more data. Cases get handled consistently regardless of who the subject is. When a case does not substantiate, it closes cleanly rather than leaving a lingering question mark on someone's record. Objective 3: Hand off cleanly when a case becomes something else Cases that move to investigation or incident response arrive with a record that the next team can act on immediately, not one they have to reconstruct. You know where insider threat monitoring's job ends and where forensics or HR involvement begins, and you do not sit on a case past that line. Findings that reveal a systemic gap, not just an individual case, reach the people who can fix the gap. Objective 4: Improve what the program watches for over time Detection logic gets tuned based on what real cases actually looked like, not left static after initial setup. Near misses and lessons learned change what the program monitors going forward. You can explain the program's current blind spots honestly, rather than presenting coverage as complete. What You Bring Minimum Required Experience Minimum of five (5) years of professional experience leading the cyber component of an insider threat program An in-depth understanding of the principles, methodologies, and best practices for establishing, operating, and maturing an insider threat program. Active Certified Information Systems Security Professional (CISSP) Bachelor's degree in computer science, Engineering, STEM, Information Technology, or Cybersecurity Preferred Experience You have run or been a senior analyst in an insider threat program, ideally in a federal or cleared environment where NITTF-aligned or equivalent standards applied. You have handled a case that involved coordination with HR, legal, or security partners, and can describe how you kept it proportional. You have tuned detection logic based on real case outcomes rather than left it as originally configured. You can explain a sensitive finding to people outside the program in terms they can act on without oversharing what they should not see. You hold an active CBP BI, a fitness determination at another DHS component, or an active DoD clearance. Any of these shortens your start date. You are comfortable working closely with human behavior data and understand the privacy and legal boundaries around it, not only the technical monitoring tools. Counter-intelligence experience Digital Forensics and related certifications User Activity Monitoring (UAM) User Behavior Analytics (UBA) A note on timing We are staffing this program now. If you already hold an active CBP BI and EOD, your start date is short and a $10,000 signing bonus comes with the role, payable after 90 days under standard terms. We would like to talk this week. If you do not, we can begin processing a CBP BI for you. That takes months rather than weeks, so applying now means joining a pipeline rather than starting immediately. We would rather tell you that up front than have you find out after you apply. Employee Benefits Agile's benefits offerings include, dependent upon position, Health Insurance, Life Insurance, Paid Time Off, Holiday Pay, short-term and long-term Disability, Retirement and Learning and Development opportunities as well as other optional benefit elections. Our Core Values Employees of Agile Defense are our number one priority, and the importance we place on our culture here is fundamental. Our culture is alive and evolving, but it always stays true to its roots. Here, you are valued as a family member, and we believe that we can accomplish great things together. Agile Defense has been highly successful in the past few years due to our employees and the culture we create together. What makes us Agile? We call it the 6Hs, the values that define our culture and guide everything we do. Together, these values infuse vibrancy, integrity, and a tireless work ethic into advancing the most important national security and critical civilian missions. It's how we show up every day. It's who we are. Happy - Be Infectious. Happiness multiplies and creates a positive and connected environment where motivation and satisfaction have an outsized effect on everything we do. Helpful - Be Supportive. Being helpful is the foundation of teamwork, resulting in a supportive atmosphere where collaboration flourishes, and collective success is celebrated. Honest - Be Trustworthy. Honesty serves as our compass, ensuring transparent communication and ethical conduct, essential to who we are and the complex domains we support. Humble - Be Grounded. Success is not achieved alone, humility ensures a culture of mutual respect, encouraging open communication, and a willingness to learn from one another and take on any task. Hungry - Be Eager. Our hunger for excellence drives an insatiable appetite for innovation and continuous improvement, propelling us forward in the face of new and unprecedented challenges. Hustle - Be Driven. Hustle is reflected in our relentless work ethic, where we are each committed to going above and beyond to advance the mission and achieve success. Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.
Job Description Job Description About Agile Defense At Agile Defense we know that action defines the outcome and new challenges require new solutions. That's why we always look to the future and embrace change with an unmovable spirit and the courage to build for what comes next. Our vision is to bring adaptive innovation to support our nation's most important missions through the seamless integration of advanced technologies, elite minds, and unparalleled agility-leveraging a foundation of speed, flexibility, and ingenuity to strengthen and protect our nation's vital interests. Title: Vulnerability Assessment (VA) Team Lead (CBP) Clearance: Active Top Secret Clearance with SCI eligibility, ability to obtain and maintain a CBP Background Investigation (CBP BI) and EOD, active BI strongly preferred. We can begin processing for candidates who do not hold one. Citizenship: U.S. Citizenship required Location: Reston, VA - Hybrid 3-5 days Salary Range: $155,000-175,000 Required Certification(s): One of the following: Active Certified Information Security Manager or Active Certified Information Security System Professional. The Role U.S. Customs and Border Protection runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. Every system supporting that mission has weaknesses somewhere, and the job is not to pretend otherwise. It is to find them before someone else does, and to make sure the ones that matter actually get fixed instead of sitting on a list nobody prioritizes. You lead vulnerability assessment for this program. You will run the scanning, assessment, and prioritization work that finds weaknesses across the environment, and you own getting real remediation out of that work rather than a report that lands and goes nowhere. You will coordinate closely with the network, cloud, and security engineering teams who fix what you find, and hand confirmed exploitable findings to the threat hunt and incident response leads when they need that context. One thing is worth knowing before you apply. A vulnerability scan is the easy part. What makes this role hard is getting busy engineering teams to prioritize a fix for something that has not caused a problem yet, and doing that without becoming the person everyone tunes out. What Success Looks Like Objective 1: Find what actually matters, not just what a scanner flags Findings get prioritized by real exploitability and impact to this environment, not just a generic severity score. You can tell the difference between a finding that is theoretical and one that is genuinely reachable, and you communicate that difference. Assessment coverage reaches the systems that matter most, not just the ones that are easiest to scan. Objective 2: Get real remediation, not just a report Findings that get flagged as critical get fixed, and you can show the trend closing over time. Engineering teams bring you into the fix, not just the finding, when the remediation is not obvious. Recurring finding types get traced to a build standard or process gap and closed at the source. Objective 3: Keep the risk picture current and honest What is reported as open, in progress, or accepted matches reality at any given time. Accepted risk decisions are documented with a real justification, not left as findings that quietly stopped getting tracked. Leadership gets an accurate picture of the environment's exposure, including what has not been assessed yet. Objective 4: Build assessment practice that keeps pace with a changing environment New systems and changes get assessed before they go live, not discovered later in a routine scan. Assessment methodology improves based on what real findings turned out to matter, rather than staying static. You can name where assessment coverage is thin and what it would take to close that gap. What You Bring Minimum reuired experience One of the following certifications: CISM or CISSP Minimum of five (5) years' experience performing vulnerability assessments for an enterprise network, this includes endpoints, network devices, IOT devices, web applications, databases or wireless access points. Analyzing vulnerabilities and providing assessments and remediation instructions; knowledgeable to maintain a repository of VA application issues and report application issues to USG Government customers. Experience with applying Information Systems Security principles and methods. Experience with Application Security implementation; understanding of Firewall Management and Advanced Threat Protection; familiarity with Access Control, Authorization, Intrusion Prevention and Intrusion Detection. Familiar with FISMA compliance and Risk Management Framework.B Bachelor's Degree computer science, engineering, cybersecurity or STEM. Preferred Experience You have led vulnerability assessment or penetration testing work that produced findings engineering teams actually acted on. You have prioritized findings by real exploitability rather than by scanner severity score alone, and can describe how. You have worked in a federal or highly regulated environment and know what that adds to remediation timelines and risk acceptance processes. You have gotten a team to fix something that had not caused a visible problem yet, and can describe how you made the case. You hold an active CBP BI, a fitness determination at another DHS component, or an active DoD clearance. Any of these shortens your start date. Certifications such as OSCP, GPEN, or equivalent are useful, but they are not a substitute for having driven real remediation. Any of the foloowing certifications for VAT Analysts: GPEN, GWAPT, GSNA, GAWN, GWEB, GXPN, CEH, OSCP, OSEE, OSCE, OSWP. Leadership experience of a technical team. A note on timing We are staffing this program now. If you already hold an active CBP BI and EOD, your start date is short and a $10,000 signing bonus comes with the role, payable after 90 days under standard terms. We would like to talk this week. If you do not, we can begin processing a CBP BI for you. That takes months rather than weeks, so applying now means joining a pipeline rather than starting immediately. We would rather tell you that up front than have you find out after you apply. Employee Benefits Agile's benefits offerings include, dependent upon position, Health Insurance, Life Insurance, Paid Time Off, Holiday Pay, short-term and long-term Disability, Retirement and Learning and Development opportunities as well as other optional benefit elections. Our Core Values Employees of Agile Defense are our number one priority, and the importance we place on our culture here is fundamental. Our culture is alive and evolving, but it always stays true to its roots. Here, you are valued as a family member, and we believe that we can accomplish great things together. Agile Defense has been highly successful in the past few years due to our employees and the culture we create together. What makes us Agile? We call it the 6Hs, the values that define our culture and guide everything we do. Together, these values infuse vibrancy, integrity, and a tireless work ethic into advancing the most important national security and critical civilian missions. It's how we show up every day. It's who we are. Happy - Be Infectious. Happiness multiplies and creates a positive and connected environment where motivation and satisfaction have an outsized effect on everything we do. Helpful - Be Supportive. Being helpful is the foundation of teamwork, resulting in a supportive atmosphere where collaboration flourishes, and collective success is celebrated. Honest - Be Trustworthy. Honesty serves as our compass, ensuring transparent communication and ethical conduct, essential to who we are and the complex domains we support. Humble - Be Grounded. Success is not achieved alone, humility ensures a culture of mutual respect, encouraging open communication, and a willingness to learn from one another and take on any task. Hungry - Be Eager. Our hunger for excellence drives an insatiable appetite for innovation and continuous improvement, propelling us forward in the face of new and unprecedented challenges. Hustle - Be Driven. Hustle is reflected in our relentless work ethic, where we are each committed to going above and beyond to advance the mission and achieve success. Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.
11/06/2026
Full time
Job Description Job Description About Agile Defense At Agile Defense we know that action defines the outcome and new challenges require new solutions. That's why we always look to the future and embrace change with an unmovable spirit and the courage to build for what comes next. Our vision is to bring adaptive innovation to support our nation's most important missions through the seamless integration of advanced technologies, elite minds, and unparalleled agility-leveraging a foundation of speed, flexibility, and ingenuity to strengthen and protect our nation's vital interests. Title: Vulnerability Assessment (VA) Team Lead (CBP) Clearance: Active Top Secret Clearance with SCI eligibility, ability to obtain and maintain a CBP Background Investigation (CBP BI) and EOD, active BI strongly preferred. We can begin processing for candidates who do not hold one. Citizenship: U.S. Citizenship required Location: Reston, VA - Hybrid 3-5 days Salary Range: $155,000-175,000 Required Certification(s): One of the following: Active Certified Information Security Manager or Active Certified Information Security System Professional. The Role U.S. Customs and Border Protection runs continuous operations across more than 300 land, air, and sea ports of entry, plus Border Patrol stations and the Air and Marine Operations Center. Every system supporting that mission has weaknesses somewhere, and the job is not to pretend otherwise. It is to find them before someone else does, and to make sure the ones that matter actually get fixed instead of sitting on a list nobody prioritizes. You lead vulnerability assessment for this program. You will run the scanning, assessment, and prioritization work that finds weaknesses across the environment, and you own getting real remediation out of that work rather than a report that lands and goes nowhere. You will coordinate closely with the network, cloud, and security engineering teams who fix what you find, and hand confirmed exploitable findings to the threat hunt and incident response leads when they need that context. One thing is worth knowing before you apply. A vulnerability scan is the easy part. What makes this role hard is getting busy engineering teams to prioritize a fix for something that has not caused a problem yet, and doing that without becoming the person everyone tunes out. What Success Looks Like Objective 1: Find what actually matters, not just what a scanner flags Findings get prioritized by real exploitability and impact to this environment, not just a generic severity score. You can tell the difference between a finding that is theoretical and one that is genuinely reachable, and you communicate that difference. Assessment coverage reaches the systems that matter most, not just the ones that are easiest to scan. Objective 2: Get real remediation, not just a report Findings that get flagged as critical get fixed, and you can show the trend closing over time. Engineering teams bring you into the fix, not just the finding, when the remediation is not obvious. Recurring finding types get traced to a build standard or process gap and closed at the source. Objective 3: Keep the risk picture current and honest What is reported as open, in progress, or accepted matches reality at any given time. Accepted risk decisions are documented with a real justification, not left as findings that quietly stopped getting tracked. Leadership gets an accurate picture of the environment's exposure, including what has not been assessed yet. Objective 4: Build assessment practice that keeps pace with a changing environment New systems and changes get assessed before they go live, not discovered later in a routine scan. Assessment methodology improves based on what real findings turned out to matter, rather than staying static. You can name where assessment coverage is thin and what it would take to close that gap. What You Bring Minimum reuired experience One of the following certifications: CISM or CISSP Minimum of five (5) years' experience performing vulnerability assessments for an enterprise network, this includes endpoints, network devices, IOT devices, web applications, databases or wireless access points. Analyzing vulnerabilities and providing assessments and remediation instructions; knowledgeable to maintain a repository of VA application issues and report application issues to USG Government customers. Experience with applying Information Systems Security principles and methods. Experience with Application Security implementation; understanding of Firewall Management and Advanced Threat Protection; familiarity with Access Control, Authorization, Intrusion Prevention and Intrusion Detection. Familiar with FISMA compliance and Risk Management Framework.B Bachelor's Degree computer science, engineering, cybersecurity or STEM. Preferred Experience You have led vulnerability assessment or penetration testing work that produced findings engineering teams actually acted on. You have prioritized findings by real exploitability rather than by scanner severity score alone, and can describe how. You have worked in a federal or highly regulated environment and know what that adds to remediation timelines and risk acceptance processes. You have gotten a team to fix something that had not caused a visible problem yet, and can describe how you made the case. You hold an active CBP BI, a fitness determination at another DHS component, or an active DoD clearance. Any of these shortens your start date. Certifications such as OSCP, GPEN, or equivalent are useful, but they are not a substitute for having driven real remediation. Any of the foloowing certifications for VAT Analysts: GPEN, GWAPT, GSNA, GAWN, GWEB, GXPN, CEH, OSCP, OSEE, OSCE, OSWP. Leadership experience of a technical team. A note on timing We are staffing this program now. If you already hold an active CBP BI and EOD, your start date is short and a $10,000 signing bonus comes with the role, payable after 90 days under standard terms. We would like to talk this week. If you do not, we can begin processing a CBP BI for you. That takes months rather than weeks, so applying now means joining a pipeline rather than starting immediately. We would rather tell you that up front than have you find out after you apply. Employee Benefits Agile's benefits offerings include, dependent upon position, Health Insurance, Life Insurance, Paid Time Off, Holiday Pay, short-term and long-term Disability, Retirement and Learning and Development opportunities as well as other optional benefit elections. Our Core Values Employees of Agile Defense are our number one priority, and the importance we place on our culture here is fundamental. Our culture is alive and evolving, but it always stays true to its roots. Here, you are valued as a family member, and we believe that we can accomplish great things together. Agile Defense has been highly successful in the past few years due to our employees and the culture we create together. What makes us Agile? We call it the 6Hs, the values that define our culture and guide everything we do. Together, these values infuse vibrancy, integrity, and a tireless work ethic into advancing the most important national security and critical civilian missions. It's how we show up every day. It's who we are. Happy - Be Infectious. Happiness multiplies and creates a positive and connected environment where motivation and satisfaction have an outsized effect on everything we do. Helpful - Be Supportive. Being helpful is the foundation of teamwork, resulting in a supportive atmosphere where collaboration flourishes, and collective success is celebrated. Honest - Be Trustworthy. Honesty serves as our compass, ensuring transparent communication and ethical conduct, essential to who we are and the complex domains we support. Humble - Be Grounded. Success is not achieved alone, humility ensures a culture of mutual respect, encouraging open communication, and a willingness to learn from one another and take on any task. Hungry - Be Eager. Our hunger for excellence drives an insatiable appetite for innovation and continuous improvement, propelling us forward in the face of new and unprecedented challenges. Hustle - Be Driven. Hustle is reflected in our relentless work ethic, where we are each committed to going above and beyond to advance the mission and achieve success. Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.
Job Description Job Description Application Security Manager Employment Type: Full-time Department : Global Cybersecurity Role Reports to: Security Operations Leader Location: Americas Work Arrangement: Hybrid -Denver or Remote Scope: Regional JOB SUMMARY Enterprise Application Portfolio - The Application Security Manager is responsible for leading the organization's Application Security program, ensuring that security is integrated throughout the Application Cycle (SDLC). This role partners closely with the software teams, cloud, architecture, infrastructure, and potentially product teams to identify, assess, and mitigate application security risks while enabling secure software delivery. The successful candidate will lead a team of application security analysts, establish secure development standards, oversee security testing programs, and drive adoption of security best practices aligned with industry standards such as NIST SP 800-218 (Secure Software Development Framework), NIST Cybersecurity Framework (CSF) 2.0, OWASP, and CIS Controls. ESSENTIAL DUTIES (or key responsibilities) Application Security Leadership Collaborate with other global and regional leaders within to develop the enterprise Application Security strategy. Lead, mentor, and develop Application Security Analysts. Define AppSec metrics, KPIs, and maturity goals in collaboration with regional and global security leaders. Secure Software Lifecycle Integrate security into all phases of the enterprise application portfolio. Ensure security requirements are incorporated during design and architecture reviews. Promote security-by-design principles across application teams. Security Testing Manage and oversee: Static Application Security Testing (SAST) Dynamic Application Security Testing (DAST) Software Composition Analysis (SCA) Interactive Application Security Testing (IAST) API Security Testing Container Security Infrastructure as Code (IaC) Security Mobile Application Security Testing Secrets Detection Review findings, prioritize remediation, and validate fixes. Assist in Supply Chain Security Threat Modeling Facilitate threat modeling sessions with development teams. Identify abuse cases and attack paths. Recommend architectural improvements. Ensure high-risk applications undergo formal security architecture reviews. Vulnerability Management Establish application vulnerability management processes Prioritize remediation using risk-based methodologies Track remediation SLAs Report vulnerability metrics to executive leadership Coordinate penetration testing remediation activities Threat Intelligence Cloud Application Security Support secure development within cloud platforms including: AWS Client Azure Google Cloud Platform Secure Code Reviews Conduct manual secure code reviews Review high-risk applications Provide secure coding guidance Coach development teams on remediation API Security Establish and set-up safe rules Find weak spots through testing Monitor logs to spot shadow APIs and strange traffic patterns Security Awareness Collaboration on training programs covering: OWASP Top 10 Secure Coding API Security Cloud Security Common software vulnerabilities Secure design principles Application Risk Management Perform application security risk assessments. Support enterprise application risk management initiatives. Incident Response Support cyber incident response by: Investigating application security incidents. Supporting forensic analysis. Identifying root causes. Leading post-incident reviews. Developing preventive controls. Compliance Support compliance initiatives including: NIST CSF 2.0 NIST SP 800-218 (SSDF) NIST SP 800-53 OWASP ASVS PCI DSS HIPAA SOX ISO/IEC 27001 SOC 2 MINIMUM QUALIFICATION REQUIREMENTS Education Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field. Master's degree preferred. Experience 8-10+ years of cybersecurity experience. 5+ years in Application Security. 3+ years leading security teams. Experience implementing enterprise DevSecOps programs. Experience working with Agile and CI/CD environments. Experience with cloud-native application security. -Or- An equivalent competency level acquired through a variation of these qualifications may be considered. Certificates, Licenses, Registrations CISSP CSSLP GIAC Web Application Penetration Tester (GWAPT) GIAC Secure Software Programmer (GSSP) Certified Cloud Security Professional (CCSP) Certified Information Security Manager (CISM) Client Certified: Cybersecurity Architect Expert Client Certified: Azure Security Engineer Associate Korn Ferry Competencies Leadership Competencies Strong people leadership Strategic planning Executive communication Stakeholder management Cross-functional collaboration Risk-based decision making Program management Coaching and mentoring Conflict resolution Continuous improvement mindset Key Performance Indicators (KPIs) Critical vulnerability remediation SLA compliance Mean time to remediate (MTTR) Percentage of applications covered by SAST, DAST, and SCA Security defects identified pre-production Reduction in high-risk application vulnerabilities CI/CD pipeline security coverage Secure code review completion rate Threat model completion rate Developer secure coding training completion Penetration test remediation completion Application security maturity score Audit and compliance findings related to application security PHYSICAL REQUIREMENTS Typical Office Environment requirements include: reading, speaking, hearing, close vision, traverse, bending, sitting, and occasional lifting up to 20 pounds. Target Pay Range: $120-165k - Salary to be determined by the education, experience, knowledge, skills, and abilities of the applicant, internal equity, and alignment with market data Target Bonus on Base: 15.0%
11/05/2026
Full time
Job Description Job Description Application Security Manager Employment Type: Full-time Department : Global Cybersecurity Role Reports to: Security Operations Leader Location: Americas Work Arrangement: Hybrid -Denver or Remote Scope: Regional JOB SUMMARY Enterprise Application Portfolio - The Application Security Manager is responsible for leading the organization's Application Security program, ensuring that security is integrated throughout the Application Cycle (SDLC). This role partners closely with the software teams, cloud, architecture, infrastructure, and potentially product teams to identify, assess, and mitigate application security risks while enabling secure software delivery. The successful candidate will lead a team of application security analysts, establish secure development standards, oversee security testing programs, and drive adoption of security best practices aligned with industry standards such as NIST SP 800-218 (Secure Software Development Framework), NIST Cybersecurity Framework (CSF) 2.0, OWASP, and CIS Controls. ESSENTIAL DUTIES (or key responsibilities) Application Security Leadership Collaborate with other global and regional leaders within to develop the enterprise Application Security strategy. Lead, mentor, and develop Application Security Analysts. Define AppSec metrics, KPIs, and maturity goals in collaboration with regional and global security leaders. Secure Software Lifecycle Integrate security into all phases of the enterprise application portfolio. Ensure security requirements are incorporated during design and architecture reviews. Promote security-by-design principles across application teams. Security Testing Manage and oversee: Static Application Security Testing (SAST) Dynamic Application Security Testing (DAST) Software Composition Analysis (SCA) Interactive Application Security Testing (IAST) API Security Testing Container Security Infrastructure as Code (IaC) Security Mobile Application Security Testing Secrets Detection Review findings, prioritize remediation, and validate fixes. Assist in Supply Chain Security Threat Modeling Facilitate threat modeling sessions with development teams. Identify abuse cases and attack paths. Recommend architectural improvements. Ensure high-risk applications undergo formal security architecture reviews. Vulnerability Management Establish application vulnerability management processes Prioritize remediation using risk-based methodologies Track remediation SLAs Report vulnerability metrics to executive leadership Coordinate penetration testing remediation activities Threat Intelligence Cloud Application Security Support secure development within cloud platforms including: AWS Client Azure Google Cloud Platform Secure Code Reviews Conduct manual secure code reviews Review high-risk applications Provide secure coding guidance Coach development teams on remediation API Security Establish and set-up safe rules Find weak spots through testing Monitor logs to spot shadow APIs and strange traffic patterns Security Awareness Collaboration on training programs covering: OWASP Top 10 Secure Coding API Security Cloud Security Common software vulnerabilities Secure design principles Application Risk Management Perform application security risk assessments. Support enterprise application risk management initiatives. Incident Response Support cyber incident response by: Investigating application security incidents. Supporting forensic analysis. Identifying root causes. Leading post-incident reviews. Developing preventive controls. Compliance Support compliance initiatives including: NIST CSF 2.0 NIST SP 800-218 (SSDF) NIST SP 800-53 OWASP ASVS PCI DSS HIPAA SOX ISO/IEC 27001 SOC 2 MINIMUM QUALIFICATION REQUIREMENTS Education Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field. Master's degree preferred. Experience 8-10+ years of cybersecurity experience. 5+ years in Application Security. 3+ years leading security teams. Experience implementing enterprise DevSecOps programs. Experience working with Agile and CI/CD environments. Experience with cloud-native application security. -Or- An equivalent competency level acquired through a variation of these qualifications may be considered. Certificates, Licenses, Registrations CISSP CSSLP GIAC Web Application Penetration Tester (GWAPT) GIAC Secure Software Programmer (GSSP) Certified Cloud Security Professional (CCSP) Certified Information Security Manager (CISM) Client Certified: Cybersecurity Architect Expert Client Certified: Azure Security Engineer Associate Korn Ferry Competencies Leadership Competencies Strong people leadership Strategic planning Executive communication Stakeholder management Cross-functional collaboration Risk-based decision making Program management Coaching and mentoring Conflict resolution Continuous improvement mindset Key Performance Indicators (KPIs) Critical vulnerability remediation SLA compliance Mean time to remediate (MTTR) Percentage of applications covered by SAST, DAST, and SCA Security defects identified pre-production Reduction in high-risk application vulnerabilities CI/CD pipeline security coverage Secure code review completion rate Threat model completion rate Developer secure coding training completion Penetration test remediation completion Application security maturity score Audit and compliance findings related to application security PHYSICAL REQUIREMENTS Typical Office Environment requirements include: reading, speaking, hearing, close vision, traverse, bending, sitting, and occasional lifting up to 20 pounds. Target Pay Range: $120-165k - Salary to be determined by the education, experience, knowledge, skills, and abilities of the applicant, internal equity, and alignment with market data Target Bonus on Base: 15.0%
VANGUARD CHARITABLE ENDOWMENT PROGRAM
Malvern, Pennsylvania
Job Description Job Description JOB SUMMARY Supports the reliability, resilience, performance, and continuous improvement of Vanguard Charitable's technology services. The role combines operational engineering, monitoring, automation, technical incident response, and service support responsibilities while helping the organization mature toward a more proactive and data-driven operating model. Working closely with service owners, engineering teams, vendors, and the IT Service Management & Support Lead, the analyst helps improve observability, reduce operational risk, strengthen disaster recovery readiness, support technical troubleshooting, and automate repetitive operational activities. The position also serves as a catalyst for operational innovation by applying Microsoft Copilot, Claude, automation technologies, and modern operational practices to improve productivity, reduce manual effort, strengthen knowledge sharing, and enhance business outcomes. ESSENTIAL JOB FUNCTIONS Evaluate the health, availability, performance, and reliability of technology services; develop and improve monitoring, alerting, dashboards, observability practices, and operational reporting that improve visibility and early issue detection. (20%) Support incident triage, troubleshooting, technical investigation, and service restoration activities by analyzing alerts, logs, telemetry, configuration data, and system dependencies in partnership with engineering teams, vendors, and service owners. (15%) Develop, maintain, and improve operational runbooks, recovery procedures, synthetic testing, resilience validation activities, and technical readiness standards that improve supportability and operational consistency. (15%) Leverage Microsoft Copilot, Claude, automation tools, scripting, and workflow technologies to improve productivity, documentation, reporting, troubleshooting, knowledge management, and operational effectiveness; develop reusable prompts, templates, and automation solutions that reduce manual effort across Platform Operations. (20%) Support disaster recovery, resilience testing, recovery validation, capacity planning, and operational readiness efforts; identify reliability risks and recommend actions that strengthen recovery capabilities and service continuity. (10%) Provide secondary Help Desk and operational support coverage, support service-request fulfillment, assist with escalation triage, maintain support knowledge, and help ensure continuity during colleague absences, periods of elevated demand, and business-critical events. (15%) Maintain operational documentation, dependency records, support information, and configuration data while participating in special projects and continuous-improvement initiatives. (5%) QUALIFICATIONS Education & Training Bachelor's degree in Information Technology, Computer Science, Engineering, Business, or a related discipline required; equivalent experience may be considered. Training or coursework related to systems administration, cloud technologies, platform operations, automation, reliability engineering, AI, or IT operations preferred. Licensure & Certification Microsoft, AWS, ITIL, observability/monitoring, automation, cybersecurity, AI, or related certifications preferred. Knowledge, Skill, and Ability Strong understanding of technology operations, system reliability, monitoring, troubleshooting, and operational support. Working knowledge of observability, incident response, automation, disaster recovery, and operational resilience concepts. Experience using monitoring, logging, reporting, and service management platforms. Ability to analyze technical issues, identify patterns, and recommend practical improvements. Experience leveraging Microsoft Copilot, Claude, automation tools, scripting, or similar technologies to improve productivity and operational effectiveness. Strong written and verbal communication skills with the ability to explain technical concepts to technical and non-technical audiences. Curious, self-directed learner with a passion for continuous improvement, automation, and operational innovation. Strong organizational skills with the ability to manage multiple priorities and operate effectively during incidents and business-critical events. Experience Four or more years of experience in technology operations, technical support, systems administration, platform operations, reliability engineering, or related disciplines. Experience supporting production technology services and participating in incident resolution activities. Experience developing operational documentation, runbooks, monitoring solutions, dashboards, or automation capabilities. Experience working with vendors, managed service providers, and cross-functional technology teams preferred. Experience applying AI capabilities, automation, or workflow improvements to real business or operational challenges preferred. Experience participating in disaster recovery, resilience testing, platform monitoring, or operational readiness activities preferred.
11/03/2026
Full time
Job Description Job Description JOB SUMMARY Supports the reliability, resilience, performance, and continuous improvement of Vanguard Charitable's technology services. The role combines operational engineering, monitoring, automation, technical incident response, and service support responsibilities while helping the organization mature toward a more proactive and data-driven operating model. Working closely with service owners, engineering teams, vendors, and the IT Service Management & Support Lead, the analyst helps improve observability, reduce operational risk, strengthen disaster recovery readiness, support technical troubleshooting, and automate repetitive operational activities. The position also serves as a catalyst for operational innovation by applying Microsoft Copilot, Claude, automation technologies, and modern operational practices to improve productivity, reduce manual effort, strengthen knowledge sharing, and enhance business outcomes. ESSENTIAL JOB FUNCTIONS Evaluate the health, availability, performance, and reliability of technology services; develop and improve monitoring, alerting, dashboards, observability practices, and operational reporting that improve visibility and early issue detection. (20%) Support incident triage, troubleshooting, technical investigation, and service restoration activities by analyzing alerts, logs, telemetry, configuration data, and system dependencies in partnership with engineering teams, vendors, and service owners. (15%) Develop, maintain, and improve operational runbooks, recovery procedures, synthetic testing, resilience validation activities, and technical readiness standards that improve supportability and operational consistency. (15%) Leverage Microsoft Copilot, Claude, automation tools, scripting, and workflow technologies to improve productivity, documentation, reporting, troubleshooting, knowledge management, and operational effectiveness; develop reusable prompts, templates, and automation solutions that reduce manual effort across Platform Operations. (20%) Support disaster recovery, resilience testing, recovery validation, capacity planning, and operational readiness efforts; identify reliability risks and recommend actions that strengthen recovery capabilities and service continuity. (10%) Provide secondary Help Desk and operational support coverage, support service-request fulfillment, assist with escalation triage, maintain support knowledge, and help ensure continuity during colleague absences, periods of elevated demand, and business-critical events. (15%) Maintain operational documentation, dependency records, support information, and configuration data while participating in special projects and continuous-improvement initiatives. (5%) QUALIFICATIONS Education & Training Bachelor's degree in Information Technology, Computer Science, Engineering, Business, or a related discipline required; equivalent experience may be considered. Training or coursework related to systems administration, cloud technologies, platform operations, automation, reliability engineering, AI, or IT operations preferred. Licensure & Certification Microsoft, AWS, ITIL, observability/monitoring, automation, cybersecurity, AI, or related certifications preferred. Knowledge, Skill, and Ability Strong understanding of technology operations, system reliability, monitoring, troubleshooting, and operational support. Working knowledge of observability, incident response, automation, disaster recovery, and operational resilience concepts. Experience using monitoring, logging, reporting, and service management platforms. Ability to analyze technical issues, identify patterns, and recommend practical improvements. Experience leveraging Microsoft Copilot, Claude, automation tools, scripting, or similar technologies to improve productivity and operational effectiveness. Strong written and verbal communication skills with the ability to explain technical concepts to technical and non-technical audiences. Curious, self-directed learner with a passion for continuous improvement, automation, and operational innovation. Strong organizational skills with the ability to manage multiple priorities and operate effectively during incidents and business-critical events. Experience Four or more years of experience in technology operations, technical support, systems administration, platform operations, reliability engineering, or related disciplines. Experience supporting production technology services and participating in incident resolution activities. Experience developing operational documentation, runbooks, monitoring solutions, dashboards, or automation capabilities. Experience working with vendors, managed service providers, and cross-functional technology teams preferred. Experience applying AI capabilities, automation, or workflow improvements to real business or operational challenges preferred. Experience participating in disaster recovery, resilience testing, platform monitoring, or operational readiness activities preferred.
Job Description Job Description Network Detection & Response (NDR) Engineer - Arista Focus Remote, USA Note: MUST be legally authorized to work in the United States. POSITION SUMMARY: We are seeking an experienced Network Detection & Response (NDR) Engineer to lead the deployment, optimization, and operationalization of network threat detection capabilities using the Arista security portfolio This role will be responsible for designing and tuning detection strategies, implementing effective alerting mechanisms, reducing false positives, integrating alerts with Security Operations Center (SOC) workflows, and automating incident response actions across Arista platforms and enterprise systems The ideal candidate combines strong network engineering expertise with cybersecurity operations experience, particularly in network traffic analysis, threat detection engineering, security automation, and ITSM integration KEY RESPONSIBILITIES: NDR Platform Engineering Design, deploy, configure, and maintain Arista NDR and network visibility solutions Develop network detection use cases aligned with organizational security requirements and threat models Optimize network telemetry collection, traffic visibility, packet analysis, and behavioral analytics Ensure high availability, scalability, and performance of NDR infrastructure Detection Engineering & Alert Tuning Create, test, and maintain detection rules, threat indicators, and behavioral analytics Develop alerting strategies that prioritize actionable incidents while minimizing alert fatigue Continuously tune alerts and detection logic based on SOC feedback, threat intelligence, and incident trends Analyze false-positive and false-negative events and implement improvements Establish severity classifications, escalation workflows, and operational runbooks SOC Integration & Operational Support Partner with SOC analysts to improve incident detection, triage, and response effectiveness Develop alert enrichment processes to provide analysts with actionable context Define KPIs and metrics related to alert quality, escalation rates, and detection effectiveness Participate in threat hunting activities and post-incident reviews Automation & Orchestration Design and implement automated response workflows utilizing Arista APIs and automation frameworks. Automate alert enrichment, ticket creation, incident correlation, and response actions. Develop integrations between Arista platforms, SIEM solutions, and ITSM systems. Create automated containment and remediation workflows where appropriate. ServiceNow Integration Integrate NDR-generated alerts with ServiceNow Incident Management and Security Operations workflows Build and maintain incident creation, assignment, escalation, and closure automation Develop bidirectional integrations to update incidents based on security investigation outcomes Create dashboards and report to track detection performance and response metrics Continuous Improvement Evaluate emerging threats and adapt detection content accordingly Recommend enhancements to network visibility, monitoring, and response processes Maintain technical documentation, architecture diagrams, and operational procedures Mentor junior engineers and SOC personnel on network threat detection best practices REQUIRED QUALIFICATIONS: Bachelor's degree in Computer Science, Information Security, Network Engineering, or equivalent experience At least 5+ years of experience in network security, cybersecurity operations, or detection engineering At least 3+ years of experience with Arista networking and security platforms Strong understanding of: TCP/IP, DNS, HTTP/S, routing, switching, and network architectures Network threat detection methodologies Security operations and incident response processes Security monitoring, SIEM platforms, and alert lifecycle management Experience designing and tuning security alerts in operational SOC environments Experience reducing false positives and improving detection fidelity Experience with REST APIs, automation scripting, and workflow orchestration Proficiency with Python, PowerShell, or similar automation languages Experience integrating security platforms with ServiceNow Strong analytical, troubleshooting, and communication skills PREFERRED QUALIFICATIONS: Hands-on experience with: Arista NDR platforms Arista CloudVision Arista DANZ Monitoring Fabric (DMF) Arista MSS or related security analytics technologies Experience with: SIEM platforms (Microsoft Sentinel, Splunk, QRadar, Elastic) SOAR platforms and automated incident response Threat intelligence integration Detection engineering frameworks MITRE ATT&CK mapping Familiarity with: ServiceNow Security Operations (SecOps) ServiceNow Incident Management ITSM workflow automation Python-based API integrations Infrastructure as Code and DevOps practices Relevant certifications preferred: Arista certifications CISSP GCIA GCIH CCNP Security Microsoft Security certifications DESIRED TECHNICAL COMPETENCIES: Detection Engineering Alert architecture and lifecycle management Threat modeling Behavioral analytics tuning Threat hunting Detection validation Automation API development Python scripting Workflow orchestration Event-driven automation Automated response playbooks Platform Integration Arista ecosystem integration ServiceNow integration development SIEM connectivity Ticketing automation Security data enrichment SUCCESS METRICS: The successful candidate will: Improve alert fidelity and reduce false-positive rates. Increase SOC efficiency through automation and alert enrichment. Accelerate mean time to detect (MTTD) and mean time to respond (MTTR). Develop scalable integrations between Arista tools, ServiceNow, and security platforms. Establish measurable improvements in network threat detection coverage and operational effectiveness. This role is ideal for an engineer who enjoys bridging networking, cybersecurity operations, and automation to build a highly effective network detection and response program. We are an equal opportunity employer, and we are an organization that values diversity. We welcome applications from all qualified candidates, including minorities and persons with disabilities. req26-00728
11/02/2026
Full time
Job Description Job Description Network Detection & Response (NDR) Engineer - Arista Focus Remote, USA Note: MUST be legally authorized to work in the United States. POSITION SUMMARY: We are seeking an experienced Network Detection & Response (NDR) Engineer to lead the deployment, optimization, and operationalization of network threat detection capabilities using the Arista security portfolio This role will be responsible for designing and tuning detection strategies, implementing effective alerting mechanisms, reducing false positives, integrating alerts with Security Operations Center (SOC) workflows, and automating incident response actions across Arista platforms and enterprise systems The ideal candidate combines strong network engineering expertise with cybersecurity operations experience, particularly in network traffic analysis, threat detection engineering, security automation, and ITSM integration KEY RESPONSIBILITIES: NDR Platform Engineering Design, deploy, configure, and maintain Arista NDR and network visibility solutions Develop network detection use cases aligned with organizational security requirements and threat models Optimize network telemetry collection, traffic visibility, packet analysis, and behavioral analytics Ensure high availability, scalability, and performance of NDR infrastructure Detection Engineering & Alert Tuning Create, test, and maintain detection rules, threat indicators, and behavioral analytics Develop alerting strategies that prioritize actionable incidents while minimizing alert fatigue Continuously tune alerts and detection logic based on SOC feedback, threat intelligence, and incident trends Analyze false-positive and false-negative events and implement improvements Establish severity classifications, escalation workflows, and operational runbooks SOC Integration & Operational Support Partner with SOC analysts to improve incident detection, triage, and response effectiveness Develop alert enrichment processes to provide analysts with actionable context Define KPIs and metrics related to alert quality, escalation rates, and detection effectiveness Participate in threat hunting activities and post-incident reviews Automation & Orchestration Design and implement automated response workflows utilizing Arista APIs and automation frameworks. Automate alert enrichment, ticket creation, incident correlation, and response actions. Develop integrations between Arista platforms, SIEM solutions, and ITSM systems. Create automated containment and remediation workflows where appropriate. ServiceNow Integration Integrate NDR-generated alerts with ServiceNow Incident Management and Security Operations workflows Build and maintain incident creation, assignment, escalation, and closure automation Develop bidirectional integrations to update incidents based on security investigation outcomes Create dashboards and report to track detection performance and response metrics Continuous Improvement Evaluate emerging threats and adapt detection content accordingly Recommend enhancements to network visibility, monitoring, and response processes Maintain technical documentation, architecture diagrams, and operational procedures Mentor junior engineers and SOC personnel on network threat detection best practices REQUIRED QUALIFICATIONS: Bachelor's degree in Computer Science, Information Security, Network Engineering, or equivalent experience At least 5+ years of experience in network security, cybersecurity operations, or detection engineering At least 3+ years of experience with Arista networking and security platforms Strong understanding of: TCP/IP, DNS, HTTP/S, routing, switching, and network architectures Network threat detection methodologies Security operations and incident response processes Security monitoring, SIEM platforms, and alert lifecycle management Experience designing and tuning security alerts in operational SOC environments Experience reducing false positives and improving detection fidelity Experience with REST APIs, automation scripting, and workflow orchestration Proficiency with Python, PowerShell, or similar automation languages Experience integrating security platforms with ServiceNow Strong analytical, troubleshooting, and communication skills PREFERRED QUALIFICATIONS: Hands-on experience with: Arista NDR platforms Arista CloudVision Arista DANZ Monitoring Fabric (DMF) Arista MSS or related security analytics technologies Experience with: SIEM platforms (Microsoft Sentinel, Splunk, QRadar, Elastic) SOAR platforms and automated incident response Threat intelligence integration Detection engineering frameworks MITRE ATT&CK mapping Familiarity with: ServiceNow Security Operations (SecOps) ServiceNow Incident Management ITSM workflow automation Python-based API integrations Infrastructure as Code and DevOps practices Relevant certifications preferred: Arista certifications CISSP GCIA GCIH CCNP Security Microsoft Security certifications DESIRED TECHNICAL COMPETENCIES: Detection Engineering Alert architecture and lifecycle management Threat modeling Behavioral analytics tuning Threat hunting Detection validation Automation API development Python scripting Workflow orchestration Event-driven automation Automated response playbooks Platform Integration Arista ecosystem integration ServiceNow integration development SIEM connectivity Ticketing automation Security data enrichment SUCCESS METRICS: The successful candidate will: Improve alert fidelity and reduce false-positive rates. Increase SOC efficiency through automation and alert enrichment. Accelerate mean time to detect (MTTD) and mean time to respond (MTTR). Develop scalable integrations between Arista tools, ServiceNow, and security platforms. Establish measurable improvements in network threat detection coverage and operational effectiveness. This role is ideal for an engineer who enjoys bridging networking, cybersecurity operations, and automation to build a highly effective network detection and response program. We are an equal opportunity employer, and we are an organization that values diversity. We welcome applications from all qualified candidates, including minorities and persons with disabilities. req26-00728
