Cybersecurity Analyst/Engineer

Patriot Contract Services•Houston, TX

2d•Hybrid

About The Position

Patriot Contract Services (PCS) and its affiliate Patriot Maritime are maritime government contracting companies providing management, crewing, and vessel support services to the U.S. government under contracts with MARAD and the Military Sealift Command (MSC). With approximately 83 shoreside employees and operations across multiple vessel programs — including the Ready Reserve Force (RRF), Watson-class vessels, Bob Hope vessels, and other federal maritime programs — Patriot operates at the intersection of commercial maritime expertise and federal government contracting. Headquartered in Houston, TX, our team supports the nation’s strategic sealift mission and military readiness. Patriot is seeking an experienced Cybersecurity Analyst / Engineer to build, operate, and mature the organization's information security program. The complexity of Patriot’s environment — hybrid Azure/on-premises infrastructure, an active ERP migration, federal government contract obligations, and ISO 27001, NIST and CMMC compliance requirements — demands someone with demonstrable, hands-on experience who can operate independently, interface with executive leadership, and drive measurable improvement in the company’s security posture. The ideal candidate is equally comfortable producing executive risk dashboards as they are configuring Conditional Access policies, tuning Sentinel detection rules, or leading an incident response tabletop. They bring a government contractor mindset: documentation-first, audit-ready, and compliance-aware.

Requirements

3–5+ years of hands-on experience in cybersecurity or information security engineering; mid-to-senior level background required
Demonstrated experience in a federal government contractor, defense, or similarly regulated environment strongly preferred
Prior experience with CMMC framework requirements is required
Hands-on proficiency with the Microsoft security stack: Sentinel (SIEM/SOAR), Defender for Endpoint, Defender for Cloud, Entra ID, and Conditional Access
Working knowledge of Azure security services, cloud posture management (CSPM), and hybrid infrastructure environments
Working knowledge of NIST CSF, ISO 27001, DFARS 252.204-7012, and CMMC 2.0 framework requirements
Ability to maintain audit-ready documentation, evidence libraries, and control mapping artifacts
Strong written and oral communication skills; ability to translate technical risk into business-level language for executive audiences
Demonstrated experience identifying, investigating, and mitigating cyber-enabled fraud, including business email compromise (BEC), invoice fraud, and payment diversion schemes

Nice To Haves

CISSP, CISM, CompTIA Security+, or Microsoft SC-200 / SC-300 certification (candidates with equivalent demonstrated experience will be considered)
Experience with vulnerability scanning platforms (e.g., Nessus, Qualys, Defender Vulnerability Management) and endpoint management via Intune/MEM
Familiarity with ERP security configurations or experience supporting an active ERP migration environment
Experience in a maritime, transportation, or DoD-adjacent operating environment
Certified Fraud Examiner (CFE) or equivalent fraud investigation/financial crimes credential
Security clearance eligibility (Secret preferred)

Responsibilities

Own and operate security monitoring using Microsoft Sentinel or equivalent SIEM; tune detection rules, triage alerts, and lead response to security events
Manage Defender for Endpoint, Defender for Cloud, and Microsoft Secure Score — driving measurable posture improvements on a recurring basis
Monitor identity security events, privileged access activity, and anomalous sign-in patterns via Microsoft Entra ID
Conduct regular vulnerability scanning across endpoints, servers, and cloud resources; manage a remediation pipeline in coordination with IT and third-party vendors
Track remediation status, exceptions, and risk acceptance decisions with documented evidence for compliance and audit purposes
Develop, maintain, and test Incident Response (IR) and Disaster Recovery (DR) plans; lead tabletop exercises with IT and operations stakeholders
Serve as the primary point of contact for security incidents; coordinate containment, investigation, and post-incident remediation
Administer and mature the ISO 27001 control environment; maintain a current Statement of Applicability, evidence library, and audit trail
Support DFARS/CMMC readiness efforts as contract requirements evolve, coordinating with Legal and external advisors as needed
Enforce and document adherence to NIST CSF and relevant federal compliance frameworks across PCS and ASM environments
Review and enforce Conditional Access policies, MFA enrollment, and privileged access controls; ensure Entra ID configurations align with least-privilege principles
Oversee endpoint compliance posture (Intune/MEM) and enforce security baselines across Windows endpoints
Conduct third-party and vendor security risk assessments; maintain a vendor risk register and drive remediation of identified gaps
Develop and deliver security awareness training and phishing simulation programs for all shore-based personnel
Design and deliver targeted anti-fraud training for Finance, Accounting, and HR staff covering business email compromise (BEC), invoice fraud, payroll diversion, and vendor impersonation schemes
Monitor email, financial, and payroll systems for indicators of business email compromise, invoice manipulation, wire fraud, and vendor/banking-detail change schemes
Partner with Finance, Accounting, and HR to establish and enforce verification controls for wire transfers, vendor payment changes, and payroll modifications
Configure and maintain email authentication and anti-spoofing controls (SPF, DKIM, DMARC) and mailflow rules to reduce phishing and impersonation exposure
Investigate suspected fraud incidents in coordination with Finance, Legal, and law enforcement as needed; support recovery efforts and post-incident control improvements
Stay current on emerging cyber fraud tactics (deepfake/voice-cloning impersonation, social engineering, account takeover) and proactively adapt controls and training accordingly
Produce recurring executive security dashboards and risk metrics for President, CFO, and senior leadership review
Translate technical risk into business language; contribute to contract-level security disclosures and compliance reporting as required