Senior Cyber Operations Analyst

ECS Federal•FAIRFAX, VA

2d•$170,000 - $190,000•Hybrid

About The Position

Everforth ECS is seeking a Senior Cyber Operations Analyst to support a newly established DISA AWS environment handling CUI. The role is hybrid and based at the company’s Fairfax, Virginia office, with up to three onsite days per week and additional onsite support potentially required according to operational or mission needs. The analyst serves as the primary subject matter expert for vulnerability management and endpoint security operations, independently operating ACAS and Trellix ePolicy Orchestrator (ePO) and related endpoint security capabilities. The position includes configuring and troubleshooting vulnerability scans and endpoint security policies; analyzing scan results, alerts, and vulnerability data; coordinating remediation and validating closure; and producing metrics, reports, dashboards, and operational documentation. The analyst also supports integration with the program’s SIEM and other monitoring capabilities, and provides evidence and documentation for RMF, continuous monitoring, security assessments, and authorization activities. The role reports to the Senior Information System Security Manager. The candidate must be a U.S. citizen, hold an active DoD 8140 IAT Level II certification such as Security+ or higher, and be able to obtain a Secret clearance; an active clearance is preferred. Salary is $170,000–$190,000. The posting includes a heading for general benefits but does not specify individual benefits.

Requirements

U.S. citizenship.
Ability to obtain a Secret clearance; an active clearance is preferred.
Active DoD 8140 IAT Level II certification, such as Security+ or higher.
At least 8 years of cybersecurity experience, with a strong background in vulnerability management and endpoint security.
Experience administering ACAS, including creating and modifying scans, managing targets and credentials, scheduling scans, reviewing plugin results, troubleshooting authentication issues, and producing vulnerability reports.
Experience administering Trellix and ePolicy Orchestrator (ePO), including endpoint policies, agent health, alerts, exclusions, updates, deployments, and reporting.
Ability to independently manage ACAS and Trellix operations.
Experience reviewing ACAS results, validating findings, identifying affected systems, coordinating remediation, and confirming closure through rescans.
Experience reviewing endpoint security alerts and events, determining when investigation or escalation is needed, and working with technical teams to address findings.
Experience developing vulnerability and endpoint security reports, metrics, dashboards, and spreadsheets for leadership, continuous monitoring, and POA&M tracking.
Experience developing and maintaining SOPs for vulnerability management, endpoint security, and related cyber operations in a new environment.
Ability to evaluate CVEs, DTOs, vulnerability notifications, and other security advisories to determine whether systems are affected and perform targeted validation when needed.
Working knowledge of Windows, Linux, networking, AWS, and Active Directory as they relate to vulnerability scanning and endpoint security.
Familiarity with DoD vulnerability management, DISA STIGs, RMF, continuous monitoring, and POA&M processes.
Strong troubleshooting, documentation, and communication skills, including the ability to work directly with engineers and system administrators to resolve security findings.
Strong problem-solving and decision-making capabilities, including the ability to assess the relative costs and benefits of potential actions and identify an appropriate solution.
Highly developed interpersonal and oral and written communication skills, with the ability to interact effectively and professionally with diverse stakeholders, from peers and end users to executive management.
Ability to work in a hybrid capacity from Fairfax, Virginia, up to three days per week; additional onsite support may be required based on operational or mission needs.

Nice To Haves

Active Secret clearance.
Experience with Microsoft Defender or similar endpoint security platforms.

Responsibilities

Serve as the primary operational subject matter expert for ACAS vulnerability management and endpoint security capabilities.
Operate and configure ACAS, including scan policies, targets, credentials, schedules, plugin settings, and vulnerability reporting.
Operate approved endpoint security technologies such as Trellix, Microsoft Defender, or similar platforms, including policies, settings, agent health, exclusions, alerts, and security coverage.
Create, modify, and execute routine, targeted, and ad hoc vulnerability scans based on operational requirements, DTOs, CVEs, and other cybersecurity directives.
Troubleshoot credentialed scanning, authentication failures, incomplete scan coverage, plugin issues, and other conditions affecting scan results.
Analyze vulnerability results to identify affected assets, validate findings, identify trends, support remediation, and verify closure through rescanning.
Review and investigate endpoint security alerts, malware detections, policy violations, and suspicious activity; coordinate escalation to the SOC when further investigation or incident response is required.
Tune endpoint security policies, configurations, and exclusions to reduce false positives while maintaining required protections.
Evaluate DTOs, CVEs, vulnerability notifications, and emerging security issues to determine potential environmental impact and coordinate validation activities.
Develop vulnerability and endpoint security dashboards, metrics, reports, spreadsheets, and trend analyses for leadership, continuous monitoring, POA&M management, and authorization activities.
Develop and maintain procedures, runbooks, configuration documentation, and operational processes for vulnerability management and endpoint security.
Coordinate vulnerability remediation with technical teams, validate corrective actions, track outstanding findings, and improve the security posture.
Monitor the health and effectiveness of vulnerability scanning and endpoint security coverage, identifying gaps that require corrective action.
Support integration of vulnerability and endpoint security data with the program’s SIEM and other monitoring capabilities.
Provide technical evidence, scan results, metrics, and remediation documentation for RMF, continuous monitoring, security assessments, and authorization activities.
Continuously evaluate and improve vulnerability management, endpoint security, reporting, and remediation processes.
Perform other duties as assigned.