Role Fit & Non-Negotiables
- Onsite in Fairfax, VA — remote is not available.
- U.S. citizen required due to ITAR and government customer obligations.
- Comfortable operating as an incident leader when needed, with primary operational hours generally 8am–7pm EST.
- Hands-on ownership of security posture and DevOps/platform execution — this is not a policy-only or advisory role.
What You’ll Own (90–180 Day Outcomes)
- Establish an audit-ready Secure SDLC and begin the transition from Azure DevOps (ADO) to GitHub, aligned with FedRAMP expectations.
- Implement pragmatic CI/CD controls: SAST/SCA, secrets scanning, infrastructure-as-code scanning, environment protections, and evidence capture.
- Harden multi-cloud identity and access: federation/SSO, least privilege, break-glass, and periodic access reviews.
- Improve detection and response using Elastic; mature vulnerability management using Qualys with SLAs, dashboards, and exception governance.
- Strengthen Windows fleet security using our custom command center: patching strategy, rollout rings/canary, rollback, remote isolate, baseline hardening, and telemetry coverage.
- Stand up a repeatable operating cadence: standups, change control, incident review, postmortems, and measurable reliability/security KPIs.
Key Responsibilities
Security Leadership (Hands-On)
- Own threat modeling and security architecture across edge, cloud, and SDLC.
- Lead incident response end-to-end (triage, containment, eradication, recovery, postmortem).
- Drive identity, encryption/key management, logging, detection engineering, and secure configuration baselines.
DevOps / Platform Engineering (Hands-On)
- Own CI/CD pipelines and release governance across Kubernetes and VM-based workloads.
- Define and enforce golden paths (templates, approved patterns, environment promotion, rollback) that accelerate delivery while improving security.
- Select and standardize infrastructure-as-code approach (Terraform/CloudFormation/Bicep/Pulumi) and implement policy guardrails.
Compliance Execution (SOC 2 & FedRAMP Moderate)
- Translate compliance requirements into engineering deliverables (controls, automation, evidence, continuous monitoring).
- Partner with GRC to prepare audit-ready artifacts without creating manual, high-friction processes.
- Create operational runbooks and control evidence that meets assessor scrutiny (NIST 800-53 mindset).
People Leadership (Player/Coach)
- Lead and mentor a small SOC/NOC and DevOps team, with clear priorities and accountability.
- Create a culture of high standards: measurable goals, calm execution under pressure, and continuous improvement.
- Hire and scale the team as the platform and compliance program grows.
Required Qualifications
- 7+ years in Security Engineering, DevOps, Platform/SRE, or equivalent roles with direct production ownership.
- Demonstrated experience building and operating secure CI/CD and release governance; experience with Azure DevOps and/or GitHub Actions.
- Strong cloud security fundamentals and hands-on delivery experience in at least two of AWS/Azure/GCP (multi-cloud preferred).
- Practical Windows security experience; ability to harden and operate Windows 10/11 environments at scale (IoT/embedded a plus).
- Incident response leadership experience (performed as incident commander or equivalent).
- Hands-on experience with SIEM/telemetry operations (Elastic preferred) and vulnerability management (Qualys preferred).
- Proven ability to lead, mentor, and build a small team; able to set standards without becoming a bottleneck.
- Must be able to work onsite in Fairfax, VA; U.S. citizen.
Preferred Qualifications
- FedRAMP Moderate experience (NIST 800-53 controls, SSP support, continuous monitoring, assessor engagement) and/or SOC 2 readiness delivery.
- Kubernetes security experience (RBAC, admission control, network policy, image policy, workload identity) plus VM hardening experience.
- Software supply chain maturity: SBOM, signed artifacts/provenance, dependency governance, runner hardening, secretless authentication (OIDC).
- Device fleet operations: staged rollouts, canary rings, rollback safety, remote isolation, and resilience under intermittent connectivity.
- PKI/credential management exposure: certificate lifecycle (issue/renew/revoke), CRL/OCSP concepts, HSM/KMS custody patterns, and separation of duties.
Signals We Look For
- You can explain how you prevent CI/CD credential theft and guarantee artifact integrity (OIDC/short-lived creds, signing/provenance, environment protections).
- You have led real incidents and can describe decisions, containment steps, and postmortem-driven improvements — not just tool lists.
- You think in guardrails and golden paths: standardization that increases velocity while raising security and reliability.
- You can operate across Windows edge realities (physical exposure, patching/rings, remote isolate) and cloud control planes.
What Success Looks Like
- Security controls are implemented as automated guardrails, not manual gates; delivery speed improves while risk decreases.
- Incidents are handled predictably with documented playbooks and measurable improvements (MTTD/MTTR, recurrence reduction).
- SOC 2 and FedRAMP readiness progresses with high-quality evidence capture and continuous monitoring, minimizing manual audit churn.
- The team becomes independent and scalable, enabling a Director-level operating model.
