Senior Cyber Operations Analyst

ECS Tech Inc•Fairfax, VA

5h•$170,000 - $190,000•Hybrid

About The Position

Everforth ECS is seeking a Senior Cyber Operations Analyst to work in a hybrid capacity at its Fairfax, Virginia office. The role supports a newly established DISA AWS environment handling CUI and serves as the primary subject matter expert for vulnerability management and endpoint security operations. The analyst operates ACAS and manages Trellix, including ePO, endpoint security policies, agent health, alerts, and reporting. The role reports to the Senior Information System Security Manager. The analyst independently analyzes vulnerability and endpoint security data; configures and modifies scans and security policies; troubleshoots operational issues; develops reports and metrics; and coordinates remediation with technical teams. The position also supports continuous monitoring, RMF, security assessments, and authorization activities through operational documentation, technical evidence, and remediation tracking.

Requirements

U.S. citizenship.
Ability to obtain a Secret clearance.
Active DoD 8140 IAT Level II Security+ certification or higher.
Ability to work up to three days a week in a hybrid capacity from Fairfax, Virginia; additional onsite support may be required based on operational or mission needs.
At least 8 years of cybersecurity experience with a strong background in vulnerability management and endpoint security.
Experience administering ACAS, including creating and modifying scans, managing targets and credentials, scheduling scans, reviewing plugin results, troubleshooting authentication issues, and producing vulnerability reports.
Experience administering Trellix and ePolicy Orchestrator (ePO), including endpoint policies, agent health, alerts, exclusions, updates, deployments, and reporting.
Ability to independently manage ACAS and Trellix operations.
Experience reviewing ACAS results, validating findings, identifying affected systems, coordinating remediation, and confirming closure through rescans.
Experience reviewing endpoint security alerts and events, determining when additional investigation or escalation is needed, and working with technical teams to address findings.
Experience developing vulnerability and endpoint security reports, metrics, dashboards, and spreadsheets for cybersecurity leadership, continuous monitoring, and POA&M tracking.
Experience developing and maintaining SOPs for vulnerability management, endpoint security, and related cyber operations in a new environment.
Ability to evaluate CVEs, DTOs, vulnerability notifications, and other security advisories to determine whether systems are affected and conduct targeted validation when needed.
Working knowledge of Windows, Linux, networking, AWS, and Active Directory as they relate to vulnerability scanning and endpoint security.
Familiarity with DoD vulnerability management, DISA STIGs, RMF, continuous monitoring, and POA&M processes.
Strong troubleshooting, documentation, and communication skills, including the ability to work directly with engineers and system administrators to resolve security findings.
Strong problem-solving and decision-making capabilities, including the ability to weigh the relative costs and benefits of potential actions and identify appropriate solutions.
Highly developed interpersonal and oral and written communication skills, including the ability to interact professionally with diverse stakeholders, from peers and end users to executive management.

Nice To Haves

Active Secret clearance preferred.

Responsibilities

Serve as the primary operational subject matter expert for ACAS vulnerability management and endpoint security capabilities.
Operate and configure ACAS, including scan policies, targets, credentials, schedules, plugin settings, and vulnerability reporting.
Operate and configure approved endpoint security technologies such as Trellix, Microsoft Defender, or similar platforms, including policies, settings, agent health, exclusions, alerts, and security coverage.
Create, modify, and execute routine, targeted, and ad hoc vulnerability scans based on operational requirements, DTOs, CVEs, and other cybersecurity directives.
Troubleshoot credentialed scanning, authentication failures, incomplete scan coverage, plugin issues, and other conditions affecting scan results.
Analyze vulnerability results to identify affected assets, validate findings, identify trends, support remediation, and verify closure through rescanning.
Review and investigate endpoint security alerts, malware detections, policy violations, and other suspicious activity, coordinating escalation to the SOC when needed.
Tune endpoint security policies, configurations, and exclusions to reduce false positives while maintaining required protections.
Evaluate DTOs, CVEs, vulnerability notifications, and emerging security issues to determine potential impact and coordinate validation activities.
Develop vulnerability and endpoint security dashboards, metrics, reports, spreadsheets, and trend analysis to support cybersecurity leadership, continuous monitoring, POA&M management, and authorization activities.
Develop and maintain procedures, runbooks, configuration documentation, and operational processes for vulnerability management and endpoint security.
Coordinate vulnerability remediation with technical teams, validate corrective actions, track outstanding findings, and improve the security posture.
Monitor the health and effectiveness of vulnerability scanning and endpoint security coverage and identify gaps requiring corrective action.
Support integration of vulnerability and endpoint security data with the program's SIEM and other monitoring capabilities.
Provide technical evidence, scan results, metrics, and remediation documentation for RMF, continuous monitoring, security assessments, and authorization activities.
Continuously evaluate and improve vulnerability management, endpoint security, reporting, and remediation processes.
Perform other duties as assigned.