Information security analyst jobs in Dale City, VA

Senior Security Engineer (Information Security Analyst IV) Clearance: Public Trust (U.S. Citizen or Green Card Holder; 3+ years U.S. residency required) Business Unit: Digital Modernization Role Summary The Senior Security Engineer supports the Department of Transportation's (DOT) Cybersecurity mission by enhancing and maintaining the security posture of DOT information systems and infrastructure. These systems play a critical role in safeguarding U.S. critical infrastructure, including highways, bridges, and roadways. This position provides advanced security engineering, participates in strategic security design, and delivers technical expertise for integrated security systems and endpoint protection. The role requires independent decision-making, leadership, and the ability to guide less experienced staff. It also involves complex problem-solving, interaction with senior federal leadership, and contributions that directly impact mission and schedule outcomes. Key Responsibilities Implement endpoint protection profile changes to address external threats and enforce security requirements. Coordinate with application, infrastructure, and engineering teams to troubleshoot endpoint protection software issues. Integrate endpoint security data with security log aggregation tools, including SIEM platforms. Participate in cybersecurity incident handling activities as requested. Stay current on emerging threats, vulnerabilities, and industry best practices related to endpoint security. Work assigned cybersecurity and security operations ITSM (ServiceNow) tickets through completion. Participate in Cybersecurity and Security Operations (SecOps) meetings. Collaborate on cybersecurity solutions that enhance the DOT's security posture. Configure, validate, and test secure systems and physical controls to detect security weaknesses. Contribute to strategic security design efforts, translating business and security requirements into technical solutions. Recommend policy changes and guide others in achieving departmental cybersecurity objectives. Required Technical Skills Endpoint protection management solutions (hands-on experience). Proven understanding of Federal cybersecurity requirements, including FISMA and the NIST 800 series. Ability to articulate endpoint security concepts to non-technical stakeholders. Demonstrated experience collaborating across cross-functional cybersecurity teams. Ability to evaluate complex security problems and apply judgment within established practices and policies. Experience with integration of endpoint security data into SIEM or log aggregation tools. Experience working security operations tickets within ServiceNow. Knowledge of security systems, secure configuration, validation, and testing methodologies. Preferred / Nice-to-Have Skills Foundational understanding of: Application and technology stacks Cloud-based systems Operating systems Databases Networking Firewalls Data Loss Prevention (DLP) Endpoint security software Network IDS/IPS Host-based IDS/IPS General cybersecurity best practices and industry standards Qualifications & Experience 9+ years of experience in Cybersecurity or related IT fields. Bachelor's degree + 9 years OR Master's degree + 7 years of experience Technical Certifications (one or more required): Network+ Security+ SSCP GISF ISACA Cybersecurity Fundamentals Or similar technical cybersecurity certification Ability to obtain and maintain a Public Trust clearance. Benefits (employee contribution): Health insurance Health savings account Dental insurance Vision insurance Flexible spending accounts Life insurance Retirement plan All qualified applicants will receive consideration for employment without regard to age, race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.

Creates cyber-intelligence tools / methods and performs research and analysis in order to mitigate and eliminate data and cyber security risks. Develops acceptance criteria for cybersecurity architecture. Investigates computer and information security incidents to determine extent of compromise to national security information and automated information systems. Assists with defining security objectives and system-level performance requirements. Researches and stays abreast of tools, techniques, countermeasures, and trends in computer network vulnerabilities. Configures and validates secure systems, tests security products/systems to detect computer and information security weaknesses. Maintains the computer and information security incident, damage and threat assessment programs. Supports the formal Security Test and Evaluation (ST&E) required by each government accrediting authority through pre-test preparations, participation in the tests, analysis of the results and preparation of required reports. Involved in the periodic conduct of a review of each system's audits and monitors corrective actions until all actions are closed. Supports the development of integrated system solutions ensuring proprietary/confidential data and systems are protected. Involved in the establishment of strict program control processes to ensure mitigation of risks and supports obtaining certification and accreditation of systems. Minimum Qualifications Bachelor's Degree in Computer Science or a related field or equivalent experience. 2-4 years of experience in systems security. Other Job Specific Skills Must be able to communicate effectively and clearly present technical approaches and findings. Exercises a limited degree of latitude in determining technical objectives of assignments. Excellent attention to detail. Must be able to balance multiple tasks simultaneously. #cjpost

Role: Cybersecurity Engineer III Contract Job Responsibilities / Typical Day in the Role Implement design reviews to evaluate security controls Identify and communicate opportunities to enhance the security posture of Client Build and / or manage enterprise security platforms effectively Communicate effectively across all levels of management to articulate Client security goals and vision. Identify and communicate opportunities to enhance the security posture of Client Build and / or manage enterprise security platforms effectively (SAAS, on premise or in Cloud) Communicate effectively across all levels of management to articulate Client security goals and vision. Have a team player mentality; strive to contribute to team cohesion however can work independently if the need arises Plan, design, engineer and implement security-related technologies Understanding technical security issues, their implications within Client business units and able to effectively communicate them to management and other business leaders. Configure, troubleshoot, and maintain security infrastructure - including software and hardware in cloud environments, as well as on-premises. Conduct security audits and assessments to regularly determine the effectiveness of security platforms and identify areas of improvement. Host and operating systems hardening, auditing, monitoring and logging with appropriate security controls and best practices while meeting security best practices and business goals Research and explore emerging security technologies and determine their appropriate use within the company. Prepare, document, and create standard operating procedures and protocols. Crosstrain and mentor other team members as needed Must Have Skills / Requirements Implementing advanced cyber security technology in a complex environment 5+ years of experience; Hands-on experience in security engineering, hands-on experience in building, designing, and maintaining enterprise security tools. Scripting experience (using Python, Go, or other equivalent languages) 5+ years of experience. Hands-on Experience with automation technologies 3+ Years of experience; Terraform, Ansible, CloudFormation, etc. Linux Experience. 5+ years of experience; Ability to construct and maintain complex network infrastructures. Technology requirements: Engineer and administer security platforms including SIEM/SOAR systems, endpoint detection and response, vulnerability management, anomaly detection, and cloud analysis. Experience in managing the Brinqa vulnerability management platform and experience with Groovy programming language Must have 5+ years of scripting experience (using Python or other equivalent languages) Hands-on Experience in public cloud infrastructures like AWS (Amazon Web Services) Nice to Have Skills / Preferred Requirements Security and Cloud certifications are a plus. (CISSP, Splunk Admin, AWS Solution architect). Media/entertainment or distributed global network experience. Soft Skills Hands-on technical experience with networking and computing system architectures, specifically, the security aspects thereof. Thorough understanding of information security principles, techniques, principles, policy frameworks, and best practices Hands-on technical experience with compliance and regulatory frameworks and how they affect architecture designs and review

Chief Information Security Officer (CISO) The Chief Information Security Officer is a senior executive responsible for defining and overseeing the enterprise-wide vision, strategy, and execution of information security programs that safeguard all organizational data and technology. Reporting directly to the CEO and/or Board of Directors, the CISO plays a pivotal role in managing security risk across both the Academic/Research and Clinical/Patient Care operations of the integrated university and hospital system. Position Details Salary: $250-2750k Type: Full-time, direct hire Location: Washington DC, onsite 3 days a week Strategic Direction & Executive Leadership Build and execute a long-term cybersecurity vision that supports the institution's academic initiatives, research priorities, and clinical mission. Lead and develop the security department, offering coaching, structure, and direction to cybersecurity personnel and partner teams. Establish the organization's security policies, governance models, and standards to ensure consistent risk management practices. Oversee financial planning for cybersecurity, including technology investments, service contracts, and budget management. Risk Oversight & Regulatory Alignment Supervise all risk assessments, compliance reviews, and internal/external audits, ensuring timely closure of any identified risks. Maintain adherence to all regulatory requirements applicable to both sectors: Hospital/Clinical: HIPAA/HITECH, CMS guidelines, and relevant state-level data protection rules. University/Research: FERPA, NIST SP 800-171 for research compliance, and PCI DSS for payment and donation processing. Direct the institution's incident management program-coordinating preparation, testing, and response efforts during cybersecurity events affecting either environment. Operational Security Management Lead the selection, deployment, and ongoing support of cybersecurity technologies (e.g., SIEM tools, firewalls, intrusion detection systems, endpoint protection). Oversee vulnerability assessments, penetration testing initiatives, and continuous monitoring activities. Work closely with IT, engineering, research teams, and clinical technology leaders to incorporate secure design principles into all systems and projects. Communication, Influence & Education Act as the organization's primary authority on cybersecurity matters for executives, trustees, faculty, students, clinicians, and administrative teams. Create and oversee training and awareness programs tailored to the specific needs of academic users, researchers handling sensitive data, and clinical professionals. Provide routine briefings to senior leadership and the Board on emerging risks, ongoing initiatives, and the overall security posture. Required Qualifications Education: Bachelor's degree in Computer Science, Information Systems, or a related technical field (Master's preferred). Professional Background: At least 10 years of progressive cybersecurity experience. Minimum 5 years serving in a senior leadership capacity (e.g., CISO, Security Executive, VP of Cybersecurity). Dual-sector experience: Strong understanding of both healthcare and higher-education cybersecurity and regulatory environments. Certifications: One or more required-CISSP, CISM, or equivalent. Key Skills & Core Competencies Advanced knowledge of enterprise security design, network and cloud protection strategies, and modern risk evaluation techniques. Strong familiarity with frameworks such as NIST Cybersecurity Framework, ISO 27001, and the MITRE ATT&CK model. Outstanding leadership presence with the ability to collaborate, influence, and guide diverse groups across a complex institution. Demonstrated success in leading security incident response efforts and handling high-pressure situations. Proven ability to implement practical, scalable security practices in environments balancing open research culture with rigorous patient data protection requirements.

We are seeking a Cybersecurity Engineer with strong, hands-on experience implementing Data Loss Prevention (DLP) solutions, specifically using Azure Purview and Microsoft Intune. This role requires a technical practitioner who has directly deployed, configured, and operationalized security controls-not just monitored events. The engineer will design and implement secure architectures across cloud and hybrid environments, conduct threat modeling, integrate security into new platforms, and ensure alignment with industry best practices and regulatory frameworks such as NIST 800-53, FISMA, and FedRAMP. The ideal candidate must have 10+ years of experience that brings advanced knowledge of cloud security, IAM, encryption, authentication protocols, and modern DevSecOps practices. Additional responsibilities include developing reusable security patterns, performing architecture reviews, enhancing automation, and partnering with IT teams to mature the organization's security posture. Strong communication skills, deep technical proficiency, and experience with Azure/AWS infrastructures are essential for success in this role. This is an onsite direct hire opportunity in Arlington, VA, no contract, no sponsorship. Relocation assistance provided within the US. LI #HP-1

Employment Type: Full-Time Strategies SteerBridge Strategies is a CVE-Verified, Service-Disabled Veteran-Owned Small Business (SDVOSB) delivering a broad spectrum of professional services to the U.S. Government and private sector. Backed by decades of hands-on experience in federal acquisition and procurement, we deliver agile, best-in-class commercial solutions that drive mission success. Our strength lies in our people-especially the veterans whose leadership, discipline, and dedication shape everything we do. At SteerBridge, we don't just hire talent-we empower it. We cultivate meaningful career paths for those who have served and for those who share our commitment to excellence, innovation, and service. Position Overview SteerBridge Strategies is seeking a highly accomplished Security Architect to support our Modern Disability Claims (MDC) initiative-a transformative effort to modernize claims processing systems for the Department of Veterans Affairs (VA). This mission-critical project enhances the security, reliability, and operational efficiency of systems entrusted with sensitive Veteran information. As the Security Architect, you will serve as a strategic and technical authority, guiding cybersecurity architecture across cloud and hybrid environments, ensuring compliance with federal and VA mandates, and fortifying the systems that safeguard the data of those who have served our nation. This is a rare opportunity to apply your expertise at scale while shaping the future of secure digital services for millions of Veterans. Key Responsibilities Architect secure, scalable, and resilient solutions across cloud and hybrid infrastructures supporting VA claims systems. Partner with engineering, infrastructure, and compliance teams to embed secure design principles throughout the system lifecycle. Develop, maintain, and continuously refine System Security Plans (SSPs); lead all phases of the ATO process. Interpret and apply NIST 800-53, NIST 800-171, FedRAMP High, and VA-specific cybersecurity requirements across system and data environments. Lead full RMF lifecycle activities-from system categorization through continuous monitoring and ongoing authorization. Conduct comprehensive risk assessments, gap analyses, and vulnerability remediation planning. Oversee the creation of cyber policies, technical documentation, audit-ready control evidence, and security reporting. Coordinate and participate in security audits, penetration tests, incident response actions, and forensic investigations. Serve as a subject matter expert in data protection, encryption technologies, identity/access controls, and secure SDLC best practices. Collaborate with ISSOs, ISSEs, and federal security teams to ensure seamless security alignment and compliance. Required Qualifications U.S. Citizenship required Bachelor's or Master's degree in Cybersecurity, Information Systems, or a related field Active Secret clearance or ability to obtain one 10+ years of cybersecurity architecture experience in federal or large enterprise environments Deep expertise in NIST 800-171, NIST 800-53, FedRAMP, and federal cybersecurity frameworks Proven experience developing ATO packages and leading security authorization activities Strong background in system hardening, network security, encryption protocols, and secure SDLC Experience architecting secure solutions in AWS, Azure, and/or GCP environments Exceptional written and verbal communication skills with the ability to produce audit-ready documentation Experience coordinating with ISSOs, ISSEs, federal security teams, and cross-functional engineering groups Preferred Qualifications Certifications such as CISSP, CAP, CISM, or equivalent Cloud architecture experience or cloud-related certifications Familiarity with VA security requirements, VAEC, and Veteran-focused IT systems Hands-on experience designing solutions to FedRAMP High baselines Benefits Health Insurance Dental Insurance Vision Insurance Life Insurance 401(k) Retirement Plan with Company Matching Paid Time Off (PTO) Paid Federal Holidays A competitive salary commensurate with experience will be offered. Equal Opportunity Commitment SteerBridge Strategies is proud to be an Equal Opportunity Employer. We are committed to fostering a diverse and inclusive workplace where all qualified applicants and employees are treated with respect and dignity-regardless of race, color, gender, age, religion, national origin, ancestry, disability, veteran status, genetic information, sexual orientation, or any other characteristic protected by law. We also provide reasonable accommodations for individuals with disabilities. If you require assistance during the application process, please reach out so we can support your needs.

We are seeking a hands-on Solutions Architect who will also serve as the Information System Security Engineer (ISSE) for key cybersecurity systems supporting the Department of Veterans Affairs (VA). This role is ideal for someone with deep technical engineering skills, cloud and DevSecOps experience . This individual will also lead teams to develop and implement technical solutions to remediate vulnerabilities and other complex cybersecurity challenges. Candidates will have a solutions-oriented mindset to help the VA problem solve complex cybersecurity and IT challenges. The candidates should also be well-versed with facilitating working sessions and have the ability to distill complex concepts into non-technical/common language. The role will focus on analyzing and recommending system security architectures, vulnerability mitigation, policy-driven compliance implementation, and full-lifecycle support for the Department of Veteran's Affairs systems. Key Responsibilities: Cybersecurity Engineering & Architecture (Primary): Analyze complex technical findings and determine necessary resources needed to solve problem-sets across multiple cybersecurity and technical domains Able to partner with technical teams to develop and implement technical solutions Design, build, and deploy secure cloud-native architectures and infrastructure components for VA information systems Develop and maintain CI/CD pipelines with integrated security scanning, policy enforcement, and remediation tools Implement secure infrastructure as code/policy as code using tools such as Terraform/CloudFormation, including writing and implementing PaC scripts Align security architectures with Federal Zero Trust strategy, VA directives, and OMB policies Enable automation of system telemetry and analytics pipelines for cyber situational awareness ISSE Responsibilities: Provide engineering and technical analysis on behalf of Agency Authorizing Officials (AOs) for System Security Plans (SSPs), Risk Assessments, Security Controls Traceability Matrices (SCTMs), and POA&Ms Support system authorization and compliance activities including continuous monitoring and system audits Conduct regular and ad-hoc analysis of security control findings and develop and implement remediation strategies Minimum Qualifications: 8+ years of security engineering, DevSecOps, or cloud architecture experience Expertise in securing platforms hosted in AWS GovCloud and Azure Government Strong experience with NIST RMF, FISMA, FedRAMP, and Zero Trust architecture implementation Hands-on skills in IaC tools like Terraform and CI/CD tools such as GitLab/Jenkins, with ability to adopt new technologies if procured by the agency Experience with network isolation tools such as Palo Alto Next Generation Firewalls (NGFW) and Juniper Mist Network Access Control (NAC) solutions or comparable Demonstrated experience securing modern applications, APIs, and automated infrastructure Excellent written and oral communication skills; ability to explain complex, technical information in easily understood terms; ability to brief Senior VA leadership regularly U.S. Citizenship and ability to obtain and maintain a Public Trust clearance Bachelor's degree in computer science, Engineering, or technical equivalent with 5 years of technical experience or a total of 13 years in lieu of education Preferred Qualifications: Prior VA experience supporting VA OIS or major cybersecurity initiatives Experience authoring and maintaining ATO documentation in VA or HHS environments Experience with IoT/IoMT security solutions is a plus Knowledge of federal cybersecurity standards

Job Title: Senior Azure Security Engineer Rate: $80/Hr. w2 Job Qualifications: Skills: Security Controls, Security Tools, System Security Certifications: Active DoD 8570 IAT Level II Certification (Security+, CISSP, CISM) Experience: 10+ years of related experience Clearance Level Must Currently Possess: Secret Clearance Level Must Be Able to Obtain: None Job Description: Information Security Analyst Duties and Responsibilities: Design, implement, and maintain secure cloud architectures within Azure Government Secret classified environments Enforce zero trust principles, role-based access control (RBAC), and identity federation (e.g.,Azure AD B2B/B2C with CAC/PIV) Configure and manage security controls such as Microsoft Defender for Cloud, Key Vault, Azure Policy, NSGs, and Private Endpoints Automate compliance and security operations using PowerShell, Terraform, or ARM templates Integrate SIEM/SOAR tools (e.g., Microsoft Sentinel for IL6) for continuous monitoring, logging, and incident response Conduct vulnerability assessments and implement remediations aligned to NIST 800-53, DoD STIGs, and JSIG Collaborate with mission owners, compliance teams, and developers to ensure secure DevSecOps pipelines Support Authority to Operate (ATO) processes by generating security documentation, control evidence, and supporting audits Navigate federal systems through the authorization process to achieve and maintain Authority to Operate (ATO) Work with the ISSO, Program and DOC ITD IA teams to maintain the necessary security authorizations Develop comprehensive System Security Plans (SSPs) documenting all implemented NIST 800-53 controls Coordinate security assessments with third-party assessors Manage Plans of Actions & Milestones (POA&Ms) for addressing identified vulnerabilities Ensure continuous monitoring plans meet agency requirements Prepare authorization packages for government review Maintain ongoing compliance through change management processes Serve as the liaison between technical teams and authorizing officials Translate security requirements into actionable tasks Ensure all documentation meets the rigorous standards required for federal information systems Information Security Analyst Requirements and Qualifications: Bachelor's degree in information systems security; master's degree or equivalent professional experience in information security is preferred Active Secret clearance 5+ years in cloud security, including 2+ in Azure Government or DoD environments Strong knowledge of Azure-native security tools, IL6 data handling, and cloud networking Proficient in scripting (PowerShell, Python, or Bash) and Infrastructure as Code (ARM, Bicep, Terraform) Experiences with DoD SRG, FedRAMP High, JSIG, and ICD 503 compliance frameworks Hands-on experience with classified enclaves, hardened images, and enclave-to-enclave connectivity Comprehensive knowledge of corporate Systems/Solutions Architecture processes and trends Strong leadership, organizational, and communication skills Secret Clearance to start Knowledge of Agile software development process Required Technical Skills: SCAP, STIG, Patching, eMASS, and related RMF tools Cybersecurity, Systems Administration, implementation of RMF tools and processes Experience with gaining an ATO for systems and working the systems through the assessment and authorization process Experience working with IP networking, networking protocols and understanding of security related technologies including encryption, IPsec, PKI, VPNs, firewalls, proxy services, DNS, electronic email and access-list Excellent communication skills Experience working in Agile software development teams Experience with secure development, coding and engineering practices Experience with Cybersecurity, Information Security, and Information Technology Security processes, protocols, and procedures. Experience 10 years of relevant experience * may vary based on technical training, certification(s), or degree Experience with Cloud Security Experience working with leading firewall, network scanning and authentication technologies Experience working with internet, web, application and network security techniques Experience in Agile methodology Experience in Jira to support development team in agile environment Experience working in Federal or State government environments Ability to work independently and remotely Certification: Active DoD 8570 IAT Level II Certification (Security+, CISSP, CISM) Travel Required: Little to no travel anticipated (may be required upon customer request)

Data Intelligence LLC is seeking an experienced Senior Security Systems Engineer to support one of our premier Navy customers in Dahlgren, VA. This role provides advanced cybersecurity engineering and systems security support to U.S. Navy tactical and strategic weapons programs. The successful candidate will lead efforts related to Assessment & Authorization (A&A), Risk Management Framework (RMF) implementation, vulnerability management, and secure systems design for complex afloat and shore-based systems. This position is fully on-site in Dahlgren, VA. This position is contingent upon winning contract award. Key Responsibilities Lead cybersecurity engineering and systems security integration for U.S. Navy programs, with specific focus on tactical combat and Submarine-Launched Ballistic Missile (SLBM) systems. Perform system security engineering in accordance with DoD, DON, and NIST cybersecurity policies, standards, and best practices. Execute the full lifecycle of the Systems Engineering Technical Review (SETR) process, including design, review, and validation activities. Conduct and support Assessment and Authorization (A&A) activities under RMF, ensuring systems achieve and maintain Authorization to Operate (ATO). Manage vulnerability analysis and remediation for critical Navy systems and applications. Develop and maintain System Security Plans (SSPs), Cybersecurity Strategy and Evaluation (CSSE) documentation, and related artifacts. Design and evaluate secure network architectures and system boundaries, incorporating cybersecurity technologies such as: Firewalls, Intrusion Detection/Prevention Systems (IDS/IPS) Routers, Switches, and Cross-Domain Solutions (CDS) Host-Based Security Systems (HBSS) Provide cybersecurity guidance for Platform IT (PIT) systems, supporting both land-based and afloat/tactical environments. Contribute to cybersecurity test planning, Model-Based Systems Engineering (MBSE) integration, and secure software/hardware development. Collaborate with multidisciplinary engineering teams and Navy program offices to ensure compliance with DoD cyber and safety standards. Deliver concise technical presentations and reports to senior leadership and stakeholders. Required Skills/Experience SLBM Programs: Minimum 7 years of direct experience with Submarine-Launched Ballistic Missile (SLBM) systems; OR Other Navy Programs: At least 5 years of program-specific security engineering experience with Navy afloat/tactical combat systems (e.g., Aegis, SSDS, Zumwalt); OR General Experience: 10+ years of general security engineering experience supporting DoD systems. Minimum 5 years of engineering experience on Aegis, SSDS, Zumwalt, or other Navy tactical combat systems (for at least six senior positions on this contract). Demonstrated experience in: Cybersecurity engineering and risk management DoD/Navy Assessment & Authorization (A&A) Vulnerability management across complex networked systems Proven understanding of DoD Cybersecurity policies, RMF, and Platform IT (PIT) implementation. Experience with the SSP Validator Handbook (for SLBM programs). Familiarity with combat weapons systems and afloat/tactical environments. Hands-on experience designing and assessing secure network architectures, cyber boundaries, and defense-in-depth strategies. Experience with cyber testing, test analysis, and secure computing system development. Strong written and verbal communication skills with the ability to brief senior leadership. Certifications (Required) IAT II, IAM II, or higher (e.g., Security+, CASP+, CISSP, or equivalent) NQV certification (desired, if applicable) Security Clearance Active Top Secret Clearance required; eligibility for higher-level access may be necessary based on program needs. Data Intelligence, DI is an established small business that has supported the critical missions of our government clients since 2005. We provide full life cycle system development, systems engineering, cybersecurity, and supporting analytical and logistics support to C4ISR and other complex systems. We are an equal opportunity employer that offers competitive salaries, comprehensive benefits, a team-oriented environment, and opportunities for advancement. Our excellent employee retention record reflects our employee focus. We work with Veteran's organization to proactively hire those who have served our country. We offer medical, dental and vision insurance, 401k, PTO and 11 paid holidays. Data Intelligence is an Equal Opportunity/Affirmative Action employer. All qualified applicants will receive consideration for employment without regard to race, age, color, religion, creed, sex, sexual orientation, gender identity, national origin, disability, or protected Veteran status.

Title: Application Security Engineer Clearance Required: Public Trust Position Type: Full-Time About the company: At VivSoft, we aim to solve complex federal problems using emerging and open technologies in a collaborative and rewarding environment. VivSoft is a diverse team of strategists, engineers, designers, and creators experienced in building high performance effective softwares, with impactful organizational design and organizational dynamics for software delivery. We build secure Software Factories based on DoD reference designs and NIST Frameworks for Cloud and DevSecOps. These factories deliver AI/ML Applications, Data Science Platforms, Blockchain and Microservices for DoD, Healthcare and Civilian Agencies Job Summary: We are seeking an Application Security Engineer to support the modernization of a large-scale enterprise software development platform. This role focuses on securing CI/CD pipelines, enforcing DevSecOps best practices, and implementing automated security testing throughout the SDLC. The engineer will work closely with development and platform engineering teams to embed security into reusable templates, GitHub Actions, and deployment workflows, ensuring applications are built and deployed securely across environments. Key Responsibilities: Using GitHub Advanced security, review security findings of the organization. Review, validate, and approve request to remediate security findings. Review, validate, and approve request to dismiss security findings. Collaborate with Federal POC and FDIC security team to create and implement application security processes and standards. Identify gaps and design solutions to improve application security at the FDIC. Provide guidance to FDIC developers in regard to remediating findings when needed. Required Skills: Bachelor's degree in Computer Science, Engineering, Information Technology, or related field, or equivalent professional experience. Proficiency in at least one or two major enterprise languages (e.g., Java, .Net, C#, JavaScript) to effectively review code and understand development context. Experience integrating security tools (SAST/DAST/SCA) into CI/CD pipelines to automate vulnerability scanning. Proficient in conducting and interpreting results from SAST (Static Analysis Security Testing) DAST (Dynamic Analysis Security Testing) Manual Code Review for security flaws Deep understanding of the OWASP Top 10 and other common application security attack vectors (e.g., injection, XSS, broken access control). Knowledge of security considerations for large, complex enterprise architectures, which may include Cloud Security (AWS, Azure, or GCP), API security, and microservices.

Come Forge the Future of Machine Identity Security for Operational Technology & Industrial Control Systems Where: Tysons, VA (Hybrid) Supporting: Our CTO At Corsha we're not just selling software; we're fundamentally reshaping how the most critical industrial and operational technology (OT) systems are secured. We're a cyber startup in the DC area, driven by a mission to bring trust, resilience, and identity to the operational systems that power our world - from factories to power grids. We're building the future of machine identity security, and we need a dynamic technical evangelist to join our front lines. Tired of the Status Quo? Ready to Secure the Unseen? Here's your Opportunity: If you're an engineer who thrives on solving hard problems, isn't afraid to get your hands dirty with industrial control systems and sees the immense potential of cybersecurity in unconventional environments, then read on. We move fast, we build for impact, and we need a security visionary to help us secure the machines that matter most. Your Mission: Secure the Industrial Edge We're looking for an OT Security Engineer to be a foundational engineer for our Machine Identity Platform (mIDP), specifically tailored for the unique and challenging landscape of OT systems. Your mission: implement, integrate, and defend the security infrastructure that underpins our cutting-edge solutions, with a heavy emphasis on industrial control systems and OT networks. This isn't just about keeping the lights on. It's about building security architectures that are inherently secure, highly available, and resilient against the most sophisticated threats, often in environments where traditional IT paradigms simply don't apply. You'll be bridging the gap between cutting-edge cybersecurity technologies and the operational realities of factories, power plants, and critical infrastructure. What You'll Be Forging: Architect and Implement OT Security Solutions: Design, deploy, and manage secure architectures for our mIDP, specifically tailored for OT environments. This includes network segmentation, routing, switching, firewall configurations, and intrusion detection systems. ICS/OT System Integration: Be the subject matter expert for integrating our mIDP with industrial control systems. This involves understanding and working with common industrial protocols (Modbus, OPC UA) and architectures (e.g., Purdue Model). Machine Identity Integration: Collaborate closely with our product and engineering teams to integrate security configurations with our mIDP, ensuring seamless and secure authentication and authorization for OT devices and applications. OT Network Hardening: Implement and enforce robust security best practices, including vulnerability management and access control for OT networks. Troubleshooting and Optimization: Proactively monitor, troubleshoot, and resolve complex security issues across ICS and OT environments. Identify and implement optimizations to enhance system performance, reliability, and security. Automation and Tooling: Develop and implement automation scripts and tools (e.g., Python, Ansible) to streamline provisioning, configuration management, and operational tasks. Documentation and Knowledge Sharing: Create comprehensive documentation, runbooks, and contribute to internal knowledge sharing to ensure maintainability and scalability of our infrastructure. Stay Ahead of the Curve: Continuously research and evaluate new cybersecurity technologies, security trends, and best practices, particularly as they relate to OT and industrial control systems. Collaborate and Mentor: Work closely with cross-functional teams (software engineers, security analysts, product managers) and provide mentorship to junior team members. What You'll Bring: 5+ years of intense experience in OT security or a related role, with a proven track record in complex, high-performance, and high-stakes environments. Deep, demonstrable expertise in industrial control systems and OT environments. You've implemented security products and solutions in real-world ICS/OT environments. Strong proficiency in network security principles: Firewalls, VPNs, intrusion detection/prevention systems (IDS/IPS), network access control (NAC), and secure communication protocols. Extensive hands-on experience with OT network architectures and protocols. You're comfortable with physical hardware and understand the nuances of industrial networks. Rock solid understanding of cybersecurity principles: vulnerability management, threat modeling, and incident response. Empathy for OT/ICS environments: You totally get the unique security challenges of Operational Technology, and understand common industrial protocols (Modbus, OPC UA) and architectures (e.g., Purdue Model). This isn't just a "nice-to-have"; it's critical. Proficiency in scripting and automation: Python, Ansible, or similar languages for automating security provisioning and operations. A relentless problem-solver: You thrive on diagnosing and resolving intricate security issues under pressure, with an unwavering focus on root cause analysis. Exceptional communication and collaboration skills: You can articulate complex technical concepts clearly and work seamlessly with cross-functional teams. Bachelor's degree in Computer Science, Engineering, or a related technical field, or equivalent practical experience. Self-starter with an insatiable curiosity: You're eager to learn, adapt, and drive solutions in a rapidly evolving, high-impact startup environment. Bonus Points For: Experience with specific machine identity solutions (PKI, certificates, secrets management). Hands-on experience with Kubernetes Knowledge of software-defined networking (SDN) solutions. Relevant industry certifications (e.g., CISSP, GICSP, CISM). Experience in a fast-paced startup environment. Why Forge your Path with Corsha? Real-World Impact: Your work won't just sit on a server; it will actively defend the critical operational systems that underpin our society. This is an opportunity to make a tangible, immediate difference. Bleeding Edge: Be at the forefront of securing the intersection of cybersecurity, machine identity, and OT. We're defining the future, not just following trends. Growth & Ownership: This is a startup - your contributions will directly shape our product, our culture, and our success. You'll work with incredible people that care and have impact. Culture of Innovation: Join a team of brilliant, passionate engineers dedicated to solving the hardest problems. We foster a collaborative, intellectually stimulating, and supportive environment. Competitive Compensation & Benefits: Wellness days, Generous PTO, Company-covered healthcare, 401k matching, paid parental leave, and of course snacks, lunches, and sustenance. Ready to step up and secure the critical future of identity? Join Our Mission Today. Reach out to us with your resume and why you think you'd make a stellar Corshian to *****************. We are an Equal Opportunity Employer and reasonable accommodations may be made to enable individuals with disabilities.

ISSO Industry: Government Contracting Our client is seeking a talented ISSO to join their team. This position will support the Assistant Secretary for Administration (ASA) under guidance from the CIO's Information System Security Manager (ISSM). The candidate will ensure a portfolio of 4 systems are in compliance with applicable NIST standards, and provide standard ISSO services. The candidate will also work closely with the other ISSOs supporting the client customers to provide leadership and mentoring and ensure consistent delivery of ISSO services. ISSO Key Responsibilities: · Ensure applicable cybersecurity policies are implemented for systems and information system-related physical security also under purview. · Maintain operational security posture consistent with current security policy. · Report actual or suspected computer-security incidents to DOT CSIRC within time frames established by DOT Incident Response policy for incident types in accordance with US-CERT. · Distribute cybersecurity notices and advisories to appropriate personnel and that vendor-issued security patches are expeditiously installed. · Serve as primary security to system owners, common control providers, and users. · Serve as focal point for cybersecurity incident reporting and subsequent resolution. · Assisting ISSM in reviewing contracts for information systems under the Component's control to ensure that cybersecurity is appropriately addressed in contract language. · Ensure all security-related SDLC documentation meets all identified security needs. · Maintain Security Assessment and Authorization (SA&A) documentation for information systems under purview according to DoT Cybersecurity Policy and Compendium. · Ensure selection of NIST SP 800-53 baseline security controls are appropriate for system based on FIPS 199 security categorization, NIST SP 800-53 guidance, and supplemental DOT policy specified in DoT Cybersecurity Compendium. · Assist System Owner, Information Owner, and ISSM in recording all known security weaknesses of assigned information systems in POA&Ms IAW DoT policy and procedures. · Track all security education and awareness training conducted for personnel and contractors, as required by DoT Cybersecurity Policy and Compendium. · Provide security advice to AO and System Owner on all matters (technical and otherwise) involving security of the information system. · Ensure required updates are performed to key documents in accordance with NIST SP 800-37 for continuous monitoring. · Identify changes to systems that may impact security controls, perform security impact assessment of proposed changes, report any change in risk posture, and provide recommendations for risk mitigation. · Ensure proper backup procedures exist for assigned information systems and that procedures are performed and tested in accordance with System Security Plan. · Assist System Owner and ISSM to ensure external connections to/from DoT information systems and networks are provided by an approved DoT Trusted Internet Connection Access Provider (TICAP) or DoT-approved Managed TIC Provider Service (MTIPS). · Ensure audit logs are captured, maintained, and analyzed as required by NIST SP 800- 53 and any supplemental Departmental Cybersecurity Policy and the Compendium. · Ensure DoT enterprise information security management system (CSAM or its successors) accurately contains required information system inventory, categorization, POA&Ms and other security metrics required by DoT CIO through this policy. · Complete mandatory annual specialized information security training. ISSO Required Skills:8+ years of experience in IT Security Certified Information Systems Security Professional (CISSP) certification. Understanding of NIST 800.53 and its applicability to IT Systems. Expertise with Risk Management Framework, FEDRAMP and FISMA. Understanding authentication in the cloud environment. Experience with continuous monitoring of a cloud system Experience working on assessments with third party assessments organization (3PAO) AWS/Azure associate certified ISSO Compensation and benefits: $120,000 Company-supported medical, dental, vision, life, STD, and LTD insurance Benefits include 10 federal holidays and PTO. 401(k) with company matching Flexible Spending Accounts for commuter, medical, and dependent care expenses Tuition Assistance

At Capital One, you will help consult on initiatives, programs, and projects to raise their game in Information Security. You are pragmatic and practical in your understanding of risk and security, but also willing to know when to pull in experts and escalate. You collaborate and innovate with other teams within Capital One to push the envelope. You are comfortable with Cloud Service technologies like Security & Access Control Management, Identity & Access management and API Implementation and Management. You are familiar with various Cloud computing models to include IaaS, PaaS, and SaaS along with their architectural differences. Security is essential to what we do here, from protecting our customers to our associates. Responsibilities: Act as a central Information Security point of contact for Platform Messaging Services Coordinate and execute proactive Information Security consulting to the business and technology teams covering Infrastructure Security, Data Security, Vulnerability Management, Network Architecture and Design, API security, and User Access Management Serve as an expert in Capital One's Information Security capabilities, solutions, policies, procedures and standards Influence customers to leverage security capabilities and solutions to shift and integrate security to the left in the development processes Escalate and manage cyber security risk Provide ad hoc support on special Information Security hot topics for the business Provide regular updates to executive leadership with your line of business on the overall Information Security health and risk environment Work with line of business leadership to anticipate their objectives and needs to better serve the line of business Work with line of business to identify risks with new and existing vendor relationships Develop strategic objectives curated towards the line of business to support Cyber initiatives About You: You have a desire to work in a very fast moving, forward leaning, and modern computing environment You have a deep passion for Securing modern computing platforms You have a strong desire to continually learn about new technologies You possess strong conceptual thinking and communication skills You are able to work well under minimal supervision You are a demonstrated leader with team-oriented interpersonal skills and the ability to interface effectively with a broad range of people and roles, including upper management, IT leaders, and technology vendors You maintain calmness and clarity of thought under pressure and ability to maintain confidentiality You have a deep understanding of strategic business objectives and the ability to drive results toward those objectives Basic Qualifications: High School Diploma, GED or equivalent certification At least 6 years of experience working in cyber security or information technology At least 5 years of experience providing guidance and oversight of cyber security concepts At least 5 years of experience performing cyber security risk assessments or cyber security architecture reviews At least 5 years of experience with software design, networking, or cloud infrastructure Preferred Qualifications: Bachelor's Degree 7+ years of experience in securing a public cloud environment (e.g. AWS, GCP, Azure) At this time, Capital One will not sponsor a new applicant for employment authorization, or offer any immigration related support for this position (i.e. H1B, F-1 OPT, F-1 STEM OPT, F-1 CPT, J-1, TN, E-2, E-3, L-1 and O-1, or any EADs or other forms of work authorization that require immigration support from an employer). The minimum and maximum full-time annual salaries for this role are listed below, by location. Please note that this salary information is solely for candidates hired to perform work within one of these locations, and refers to the amount Capital One is willing to pay at the time of this posting. Salaries for part-time roles will be prorated based upon the agreed upon number of hours to be regularly worked. McLean, VA: $225,400 - $257,200 for Sr Manager, Cyber Technical Plano, TX: $204,900 - $233,800 for Sr Manager, Cyber Technical Richmond, VA: $204,900 - $233,800 for Sr Manager, Cyber Technical Candidates hired to work in other locations will be subject to the pay range associated with that location, and the actual annualized salary amount offered to any candidate at the time of hire will be reflected solely in the candidate's offer letter. This role is also eligible to earn performance based incentive compensation, which may include cash bonus(es) and/or long term incentives (LTI). Incentives could be discretionary or non discretionary depending on the plan. Capital One offers a comprehensive, competitive, and inclusive set of health, financial and other benefits that support your total well-being. Learn more at the Capital One Careers website . Eligibility varies based on full or part-time status, exempt or non-exempt status, and management level. This role is expected to accept applications for a minimum of 5 business days.No agencies please. Capital One is an equal opportunity employer (EOE, including disability/vet) committed to non-discrimination in compliance with applicable federal, state, and local laws. Capital One promotes a drug-free workplace. Capital One will consider for employment qualified applicants with a criminal history in a manner consistent with the requirements of applicable laws regarding criminal background inquiries, including, to the extent applicable, Article 23-A of the New York Correction Law; San Francisco, California Police Code Article 49, Sections ; New York City's Fair Chance Act; Philadelphia's Fair Criminal Records Screening Act; and other applicable federal, state, and local laws and regulations regarding criminal background inquiries. If you have visited our website in search of information on employment opportunities or to apply for a position, and you require an accommodation, please contact Capital One Recruiting at 1- or via email at . All information you provide will be kept confidential and will be used only to the extent required to provide needed reasonable accommodations. For technical support or questions about Capital One's recruiting process, please send an email to Capital One does not provide, endorse nor guarantee and is not liable for third-party products, services, educational tools or other information available through this site. Capital One Financial is made up of several different entities. Please note that any position posted in Canada is for Capital One Canada, any position posted in the United Kingdom is for Capital One Europe and any position posted in the Philippines is for Capital One Philippines Service Corp. (COPSSC).

Santcore Technologies is seeking a HashiCorp Vault (Enterprise) Specialist for one of our major clients in the secure financial services domain at Culpeper, VA (Hybrid - Onsite 2 days/week required). We are looking for a hands-on security engineer with deep experience in Vault Enterprise, Terraform, Ansible, and RHEL hardening. The selected consultant will work in a high-security environment and contribute to secure automation, platform integrations, and infrastructure hardening. Key Responsibilities Deploy, configure, and maintain HashiCorp Vault Enterprise clusters (including HA architectures). Monitor Vault performance, troubleshoot complex issues, and implement security hardening best practices. Integrate Vault with enterprise systems, authentication methods, and automation pipelines. Develop and maintain Terraform modules for secure infrastructure provisioning. Troubleshoot, monitor, and harden RHEL environments, including SELinux policy management. Build and maintain Ansible roles, playbooks, and automation workflows (including AWX/Ansible Tower). Assist internal teams with Vault onboarding, usage support, and operational readiness. Participate in on-call rotation as required. Maintain at least 2 days/week onsite presence in Culpeper, VA. Required Skills (Must-Have) 3+ years of experience in security engineering, platform security, or security automation. 3+ years hands-on experience managing HashiCorp Vault Enterprise, including: HA deployments Monitoring & debugging Hardening and best practices Secret engines, auth methods, integrations Strong hands-on experience with: Terraform (module development) Red Hat Enterprise Linux (troubleshooting, monitoring, hardening) Ansible (roles, playbooks, AWX/Ansible Tower) Preferred Skills Go development (particularly for custom Vault plugin development) Jenkins (automation pipelines) Splunk (dashboards, alerts, queries) ELK Stack (integration, dashboards, queries) SELinux (policy development and troubleshooting) Nice-to-Have Certifications HashiCorp Certified: Vault Associate HashiCorp Vault Operations Professional Terraform Associate Red Hat Certifications Soft Skills Analytical problem-solving and strong troubleshooting mindset Ability to work cross-functionally within security, cloud, and DevOps teams Strong documentation and communication skills Detail-oriented and committed to enterprise security best practices Adaptability in dynamic and fast-paced technical environments

GCI embodies excellence, integrity and professionalism. The employees supporting our customers deliver unique, high-value mission solutions while effectively leverage the technological expertise of our valued workforce to meet critical mission requirements in the areas of Data Analytics and Software Development, Engineering, Targeting and Analysis, Operations, Training, and Cyber Operations. We maximize opportunities for success by building and maintaining trusted and reliable partnerships with our customers and industry. At GCI, we solve the hard problems. As a Data Exploiter, a typical day will include the following duties: JOB DESCRIPTION A qualified Data Exploiter reviews, manipulates, triages, and analyzes large datasets. Candidate is responsible for supporting operational and analytical requirements. Activities include detailed log analysis, network traffic review and vulnerability risk assessment. The individual will be expected to conduct assessments of software tools and systems to identify vulnerabilities, and work with internal and external technical stakeholders to identify solutions to enrich analysis. Able to follow the entire targeting life cycle by engaging in data exploitation of requirements collection, data analysis, summary and documentation, and actionable information dissemination. KEY RESPONSIBILITIES Provide data exploitation and targeting support to the customer. Use a variety of tools and methods to extract information of foreign intelligence, counterintelligence and targeting value from digital data. Create a range of products that inform operations, drive targeting and collection, contribute to intelligence products, and support multiple customer needs. Work with a team to analyze existing software applications and tools, and recommend new technologies and methodologies to improve team performance. Write and update technical documentation such as user manuals, system documentation, training materials, processes and procedures, technical reports and targeting leads. Collaborate cross-functionally with data scientists, engineers, developers, targeters, and analysts. Analyze intrusion artifacts to identify mitigation approaches for potential network defense Provide recommendations for continuous improvement. Work alongside other team members to sustain and advance our organization's capabilities. EDUCATION AND EXPERIENCE Bachelor's degree in Computer Science, Information Technology, or other related discipline, or Equivalent combination of education, technical certifications, training, and work/military experience. REQUIRED QUALIFICATIONS Demonstrated experience conducting in-depth targeting research/analysis on priorities and diverse datasets Demonstrated experience and ability to communicate complex information and concepts to an audience of varying levels of technical experience. Demonstrated experience and ability to sort through, catalog and analyze multiple forms of data using an array of tools and methods to achieve objectives Demonstrated experience in utilizing technical targeting tools Experience reviewing and assessing network traffic and knowledge of the OSI Layers Ability to sift through large amounts of unstructured data for key data points (metadata and artifacts) Knowledge of incident response, containment, and mitigation Knowledge of common cyber-attack methods Demonstrated experience conducting detailed log analysis and system monitoring to understand system status, detect system breaches, and identify other system anomalies Demonstrated experience performing vulnerability identification, risk analysis, and remediation Ability to triage, review, identify, and correlate items of interest from numerous all source datasets Ability to evaluate worldwide security events to assess system impact and/or risk (e.g., zero day exploits, hardware failures, and/or cyber-attacks) Ability to sift through large amounts of unstructured data for key data points (i.e., metadata and artifacts) Identify and document information that can fill critical gaps Create new methodologies / algorithms for data analysis and correlation Create entity / object profiles and derived data sets that enable future opportunities and analytical efforts Prepare a range of tailored products that embody and explain findings Experience with technical collection abilities Must be eligible to obtain the required Security Clearance. DESIRED QUALIFICATIONS Python Scripting Strong understanding of VPNs, VLANs, and TCP/IP Understanding of Linux operating systems Ability to working independently with minimal supervision Experience conducting network traffic analysis Understanding of forensic tools and applications Salary Range $160,000-$200,000 Equal Opportunity Employer / Individuals with Disabilities / Protected Veterans

We are currently seeking a Cybersecurity Engineer to become part of the Federal Strategic Cyber group. Location: Arlington, VA. This is a full-time, working on-site role. The DSCM program encompasses cyber security, data analytics, engineering, technical, managerial, operational, logistical and administrative support to aid and advise DOS Cyber & Technology Security (CTS) Directorate. This includes protecting a global cyber infrastructure comprising networks, systems, information, and mobile devices all while identifying and responding to cyber risks and threats. Those supporting the DSCM program strive to leverage their expert knowledge and propose creative solutions to real-world cybersecurity challenges. About the Role Support the Security Standards & Baselines (SSB) section within the Technology, Innovation, and Engineering (TIE) Office. Identify and provide solutions to enhance and/or streamline processes and automate work flow. Need to have a strong technical background and expertise in various areas of cybersecurity. Promote awareness of security issues among management and ensure sound security principles are reflected in organizations' visions and goals. Communicate complex security concepts to both technical and non-technical stakeholders, including senior management. Possess strong problem-solving and decision-making abilities to guide the organization in making informed security decisions. Perform extensive research and documentation of security threat vectors. Provide guidance and coaching to team members. Create bulletins, alerts, and/or advisories related to published or developmental standards and/or security principal documents. Ensure that rigorous application of information security/information assurance policies, principles, and practices are implemented in the delivery of all IT services. Evaluate a wide array of existing, new, modified, and/or emerging technologies and develop recommended security configuration baselines documents that implement Departmental policy, technical security solutions, and industry best practices in alignment with Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) as much as possible. Respond to various technical and policy questions from a wide range of customers/users with guidance and clarifications. Promote awareness of cybersecurity standards and principles among the customer stakeholders, coworkers, and the Department users. Collaborate with fellow team members and various internal and external stakeholders to share information and knowledge to establish and maintain a productive line of communication. Streamline processes to improve efficiency of Mission goals. Manage information and updates in SharePoint repositories. Keep awareness of items involving fellow team members to provide back up support and coverage as needed. Qualifications: Bachelor's degree and a minimum of 5 years' of relevant experience. An additional 4 years of experience will be considered in lieu of degree/education. Either possess or obtain prior to start date ONE of the following certifications: CAP, CASP+ CE, CCISO, CCNA-Security, CISM, CISSP (or Associate), CISSP (or Associate), CND, CSSLP, CySA+, GICSP, GSEC, GSLC, Security+ CE, SSCP, PPDA, Agile IC, SNOW App Dev. Experience with DISA STIG - Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG). Experience developing and executing research plans. Experience working with Windows Server on an enterprise level. Experience managing Active Directory in a multi-domain environment. Experience working with server/application virtualization on an enterprise. Demonstrated excellence in business acumen, team orientation and strong customer service skills. U.S. citizenship required. Active Secret security clearance. Ability to obtain a final Top Secret security clearance. Highly Desired: Experience with process automation. Technical writing skills. Engineering/maintaining database infrastructure including SQL and Oracle experience. Active Directory Federation Services (ADFS), Azure, Active Directory experience. Experience developing and managing virtualized IT systems. Networking technologies experience. Configuration and/or administrating enterprise mobile device deployments experience. Experience working with Red Hat Enterprise Linux servers on an enterprise level. For any questions regarding this job announcement or the status of your application, please contact our Director of Recruiting, Mr. Brian Jennings, via email at ********************.

Vulnerability Management Specialist will perform the following: Defines, maintains, and enforces application security best practices Conduct vulnerability assessment and manual/automated code reviews Demonstrate vulnerabilities to application owners and provide mitigation recommendations Proficient in any SAST, DAST, and OSA tools. In depth knowledge with any programming language like Java, .NET, C#, etc. Performs and conducts penetration tests and manual/automated code reviews. Writes comprehensive reports including assessment-based findings, outcomes and propositions for further system security enhancement In depth Knowledge of Secure Coding best practices and OWASP top 10, SANS 25, CVE, etc. Identify AppSec related tools/conduct tool analysis, and provide recommendations Vulnerability Management Specialist will have at least five years of working knowledge and hands-on experience with five or more of the following tools: BurpSuite, SonarQube, OWASP/Maven, Fortify, Tenable, STIG Viewer, AWS Security Hub, AWS Inspector, ePO, ServiceNow, Jira, ADO, eMASS or equivalent GRC Tools. Experience in infrastructure and container scanning Minimum Qualifications Bachelor's Degree in Computer Science, Engineering, or other Engineering or Technical discipline and a minimum of 5 years of working knowledge and hands-on equivalent relevant experience. Candidates must have a Security+ certification or similar Candidates must have an active secret security clearance. Position requires on-site work in Alexandria VA 2-3 days/week. Other Job Specific Skills Working knowledge and hands-on experience with the following: BurpSuite SonarQube OWASP/Maven Fortify, Tenable STIG Viewer AWS Security Hub AWS Inspector ePO, ServiceNow Jira ADO eMASS or equivalent GRC Tools

Senior Manager, Information Security Office (ISO) Consultant At Capital One, you will help consult on initiatives, programs, and projects to raise their game in Information Security. You are pragmatic and practical in your understanding of risk and security, but also willing to know when to pull in experts and escalate. You collaborate and innovate with other teams within Capital One to push the envelope. You are comfortable with Cloud Service technologies like Storage Services, Security & Access Control Management, Container Services, and API Implementation and Management. You are familiar with various Cloud computing models to include IaaS, PaaS, and SaaS along with their architectural differences. Security is essential to what we do here, from protecting our customers to our associates. Responsibilities: The Senior Lead ISO Consultant will provide cyber security architecture advisory support needed to build the Technology & Business capabilities on a novel Modern platform, that will enable customer set-up, use, and management of a Capital One Credit Card, including Data Product. In this role, the responsibilities will include: Act as a central Information Security point of contact for the Global Payment Networks line of business Coordinate and execute proactive Information Security consulting to the business and technology teams covering Infrastructure Security, Resiliency, Data Security, Network Architecture and Design, and User Access Management Serve as an expert in Capital One's Information Security capabilities, solutions, policies, procedures and standards Collaborating with enterprise cyber teams and tech architects in defining and driving the cyber architecture strategy and guiding principles for the architecting and designing of the modern platforms. Support security architecture and implementation needs for technology modernization efforts Overseeing all cyber related dependencies across the multiple components being built for the modernization effort. Influence customers to leverage security capabilities and solutions to shift and integrate security to the left in the development processes Escalate and manage cyber security risk Provide ad-hoc support on special Information Security hot topics for the business Provide regular updates to executive leadership with your line of business on the overall Information Security health and risk environment Work with line of business leadership to anticipate their objectives and needs to better serve the line of business Support the team on collectively mapping technologies to a standardized framework in order to identify and execute on best practices in risk reduction through the configuration of cybersecurity tools and platforms. Support the development, modification, and use of capability, risk, or threat classification frameworks and standardization methodologies to facilitate the conduct of correlative capability, maturity, and effectiveness evaluations. Support data validation and communications on the impact of identified operational, compliance, process, control, and tooling gaps and potential remediation courses of action to multiple audiences, including leadership, to support the enhancement of their cybersecurity postures. About You: You have a desire to work in a very fast moving, forward leaning, and modern computing environment You have a deep passion for Securing modern computing platforms You have a strong desire to continually learn about new technologies You possess strong conceptual thinking and communication skills You are able to work well under minimal supervision You are a demonstrated leader with team-oriented interpersonal skills and the ability to interface effectively with a broad range of people and roles, including upper management, IT leaders, and technology vendors You maintain calmness and clarity of thought under pressure and ability to maintain confidentiality You have a deep understanding of strategic business objectives and the ability to drive results toward those objectives Basic Qualifications: High School Diploma, GED or equivalent certification At least 6 years of experience working in cybersecurity or information technology At least 5 years of experience providing guidance and oversight of cyber security concepts At least 5 years of experience performing cyber security risk assessments or cyber security architecture reviews At least 4 years of experience with cloud security Preferred Qualifications: Bachelor's Degree 7+ years of experience in securing a public cloud environment (AWS, GCP, Azure) 6+ years of cyber security advisory and technology consulting experience 6+ years of experience in Cyber Risk Management 3+ years of experience on cryptography, HSMs and similar systems Knowledge of HPNS, ATM, Mainframe technologies and other payment networks infrastructure technologies Experience in security integration for Mergers and Acquisitions Experience with PCI and Payment Network Compliance. Professional certifications AWS Certified Solutions Architect and Certified Information Systems Security Professional (CISSP) At this time, Capital One will not sponsor a new applicant for employment authorization, or offer any immigration related support for this position (i.e. H1B, F-1 OPT, F-1 STEM OPT, F-1 CPT, J-1, TN, E-2, E-3, L-1 and O-1, or any EADs or other forms of work authorization that require immigration support from an employer). The minimum and maximum full-time annual salaries for this role are listed below, by location. Please note that this salary information is solely for candidates hired to perform work within one of these locations, and refers to the amount Capital One is willing to pay at the time of this posting. Salaries for part-time roles will be prorated based upon the agreed upon number of hours to be regularly worked. Chicago, IL: $204,900 - $233,800 for Sr Manager, Cyber Technical McLean, VA: $225,400 - $257,200 for Sr Manager, Cyber Technical New York, NY: $245,900 - $280,600 for Sr Manager, Cyber Technical Candidates hired to work in other locations will be subject to the pay range associated with that location, and the actual annualized salary amount offered to any candidate at the time of hire will be reflected solely in the candidate's offer letter. This role is also eligible to earn performance based incentive compensation, which may include cash bonus(es) and/or long term incentives (LTI). Incentives could be discretionary or non discretionary depending on the plan. Capital One offers a comprehensive, competitive, and inclusive set of health, financial and other benefits that support your total well-being. Learn more at the Capital One Careers website . Eligibility varies based on full or part-time status, exempt or non-exempt status, and management level. This role is expected to accept applications for a minimum of 5 business days.No agencies please. Capital One is an equal opportunity employer (EOE, including disability/vet) committed to non-discrimination in compliance with applicable federal, state, and local laws. Capital One promotes a drug-free workplace. Capital One will consider for employment qualified applicants with a criminal history in a manner consistent with the requirements of applicable laws regarding criminal background inquiries, including, to the extent applicable, Article 23-A of the New York Correction Law; San Francisco, California Police Code Article 49, Sections ; New York City's Fair Chance Act; Philadelphia's Fair Criminal Records Screening Act; and other applicable federal, state, and local laws and regulations regarding criminal background inquiries. If you have visited our website in search of information on employment opportunities or to apply for a position, and you require an accommodation, please contact Capital One Recruiting at 1- or via email at . All information you provide will be kept confidential and will be used only to the extent required to provide needed reasonable accommodations. For technical support or questions about Capital One's recruiting process, please send an email to Capital One does not provide, endorse nor guarantee and is not liable for third-party products, services, educational tools or other information available through this site. Capital One Financial is made up of several different entities. Please note that any position posted in Canada is for Capital One Canada, any position posted in the United Kingdom is for Capital One Europe and any position posted in the Philippines is for Capital One Philippines Service Corp. (COPSSC).

GCI embodies excellence, integrity and professionalism. The employees supporting our customers deliver unique, high-value mission solutions while effectively leverage the technological expertise of our valued workforce to meet critical mission requirements in the areas of Data Analytics and Software Development, Engineering, Targeting and Analysis, Operations, Training, and Cyber Operations. We maximize opportunities for success by building and maintaining trusted and reliable partnerships with our customers and industry. At GCI, we solve the hard problems. As a Data Exploiter, a typical day will include the following duties: A qualified Data Exploiter reviews, manipulates, triages, and analyzes large datasets. Candidate is responsible for supporting operational and analytical requirements. Activities include detailed log analysis, network traffic monitoring, and vulnerability risk assessment. The individual will be expected to conduct assessments of software tools and systems to identify vulnerabilities, and work with internal and external technical stakeholders to identify solutions to enrich analysis. Able to follow the entire targeting life cycle by engaging in data exploitation of requirements collection, data analysis, summary and documentation, and actionable information dissemination. Able to identify, triage and exploit data collections. REQUIRED QUALIFICATIONS * Experience conducting network traffic analysis. * Prepare a range of tailored products that embody and explain findings * Ability to sift through large amounts of unstructured data for key data points (i.e., metadata and artifacts). * Demonstrated knowledge of incident response, containment, and mitigation * Knowledge of common cyber-attack methods. * Demonstrated experience conducting detailed log analysis and system monitoring to understand system status, detect system breaches, and identify other system anomalies. * Demonstrated experience performing vulnerability identification, risk analysis, and remediation. * Ability to triage, review, identify, and correlate items of interest from numerous all source datasets. * Ability to evaluate worldwide security events to assess system impact and/or risk (e.g., zero day exploits, hardware failures, and/or cyber-attacks). * Ability to identify and document information that can fill critical gaps. * Create new methodologies / algorithms for data analysis and correlation. * Create entity / object profiles and derived data sets that enable future opportunities and analytical efforts. * Experience with technical collection abilities. DESIRED QUALIFICATIONS * Experience with scripting to exploit large data sets * Strong understanding of VPNs, VLANs, and TCP/IP. * Experience with Linux operating systems. * Experience with OS hardening using tools such as CIS-CAT. * Ability to work independently with minimal supervision. * Experience with navigating an enterprise security accreditation process. * Demonstrated experience and understanding of network monitoring tools (e.g Splunk, WSUS, Snare, Wireshark, and Solarwinds). * Technical targeting experience. * Russian Language skills or demonstrated knowledge of the EE AOR REQUIRED EDUCATION AND EXPERIENCE * Bachelor's degree in Computer Science, Information Technology, or other related discipline, or equivalent combination of education, technical certifications, training, and work/military experience. KEY RESPONSIBILITIES * Provide data exploitation support to the customer. * Assist with attribution efforts related to cyber activity. * Use a variety of tools and methods to extract information of foreign intelligence, counterintelligence and targeting value from digital data. * Create a range of products that inform operations, drive targeting and collection, contribute to intelligence products, and support multiple customer needs. * Work with a team to analyze existing software applications and tools, and recommend new technologies and methodologies to improve team performance. * Write and update technical documentation such as user manuals, system documentation, training materials, processes and procedures. * Collaborate cross-functionally with data scientists, engineers, developers, targeters, and analysts. * Provide recommendations for continuous improvement. * Work alongside other team members to sustain and advance our organization's capabilities. Salary Range $134,596-$224,764 * A candidate must be a US Citizen and requires an active/current TS/SCI with Polygraph clearance. Equal Opportunity Employer / Individuals with Disabilities / Protected Veterans