Cybersecurity Operations Lead - U.S. Citizenship Required

ZenPoint Solutions•Washington, DC

2d•$170,000 - $190,000•Onsite

About The Position

ZenPoint Solutions LLC is seeking a Cybersecurity Operations Lead to direct and perform day-to-day cybersecurity operations, continuous monitoring, and incident response for an independent federal agency client. The role operates under the strategic oversight of the agency’s CIO Program Management Office and safeguards an enterprise IT environment supporting approximately 150 users and 35 systems with active Authority to Operate packages at the FIPS 199 Moderate impact level. The Lead ensures alignment with federal cybersecurity frameworks and programs, including FISMA, NIST guidelines, Zero Trust architecture, and Continuous Diagnostics and Mitigation (CDM). The position is based in Washington, DC and is fully onsite, with a potential hybrid schedule subject to COR approval; exact arrangements will be finalized after contract award. Employment is contingent on successful award of a government contract and subsequent government approval. The selected candidate must successfully obtain a favorably adjudicated Tier 2 Public Trust background investigation and be a U.S. citizen.

Requirements

U.S. citizenship and proof of citizenship if selected.
At least 8 years of specialized experience in cybersecurity operations, incident response, or Security Operations Center environments.
At least 5 years of demonstrated experience supporting federal cybersecurity programs.
Technical proficiency configuring and analyzing security events in enterprise SIEM platforms, specifically Microsoft Sentinel, including log analysis and security event correlation.
Hands-on experience with vulnerability analysis, configuration auditing, and remediation tracking using enterprise scanning tools such as Qualys.
An active Certified Information Systems Security Professional (CISSP) credential or an equivalent recognized industry cybersecurity certification.
Must successfully obtain a favorably adjudicated Tier 2 Public Trust background investigation.

Nice To Haves

Bachelor’s or Master’s degree in Cybersecurity, Information Assurance, Computer Science, or an Information Technology discipline.
Experience administering Microsoft 365 E5/G5 security workloads, including Microsoft Defender for Endpoint, Defender for Cloud Apps, Microsoft Purview DLP, and Microsoft Intune.
Operational familiarity with DHS CDM DEFEND F or CDMaaS feeds and federal dashboard integrations.
Advanced technical credentials such as GIAC Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), Microsoft Certified: Security Operations Analyst Associate (SC-200), or CompTIA Security+.
Working knowledge of ServiceNow for incident tracking, change control workflows, and automated security ticketing.
In-depth understanding of NIST SP 800-53 Rev. 5, NIST SP 800-37 (RMF), NIST SP 800-61 (Computer Security Incident Handling), and OMB Memorandum M-21-31 event logging tiers.

Responsibilities

Direct real-time monitoring of security events, logs, and alerts across workstations, mobile endpoints, and servers using Microsoft Sentinel and Microsoft Defender.
Lead incident response and escalation workflows in accordance with federal performance standards.
Manage vulnerability scanning and analysis using Qualys, coordinating with infrastructure teams to meet remediation timelines.
Support agency participation in the DHS CDM DEFEND program, maintaining continuous feeds to federal dashboards, meeting the 72-hour reporting latency target, and achieving at least 95% CDM sensor coverage.
Coordinate Microsoft 365 E5/G5 security controls, including Microsoft Purview DLP configuration, Defender policies, and mobile threat visibility through Lookout MTD and Microsoft Intune.
Support Risk Management Framework and Security Assessment and Authorization lifecycles across 35 system packages, sustaining 100% ATO compliance and at least 95% audit evidence freshness.
Author and deliver cybersecurity artifacts, including Monthly Threat Reports, Monthly Plans of Action and Milestones, and Quarterly CDM Integration Status Reports.
Enforce privileged-user controls using Microsoft Privileged Identity Management and monitor system configurations to mitigate insider risks and unauthorized access.
Provide cross-functional operational support for IT risk assessments, audit readiness reviews, and configuration baselines, targeting at least 95% secure baseline adherence.