26-1134: Zero Trust Data Pillar SME - Hybrid/ DC Metro

Navitas Business Consulting•Herndon, VA

18h•$120,000 - $180,000•Hybrid

About The Position

Navitas Business Consulting is delivering Zero Trust implementation services to USCIS, aligned to the CISA Zero Trust Maturity Model (ZTMM) v2.0, NIST SP 800-207, OMB M-22-09 and EO 14028. The Data Pillar SME owns the agency’s data pillar end to end: defining what “Advanced” and “Optimal” mean, validating maturity with evidence on the enterprise data lake, and turning data loss prevention (DLP) policy into enforced controls. The role works across the security policy branch, enterprise data platform (Databricks) team, Security Operations Center, and Chief Data Officer’s governance function. Current work includes rebaselining data-pillar requirements and KPIs across eight functions and four maturity tiers; assessing a Databricks data lake fed by 60 to 80 source systems; modernizing DLP through a phased Zscaler rollout; and advancing data classification and tagging into enforceable labels. The position leads data-pillar strategy and maturity assessments, supports governance and data protection for the Databricks lakehouse, engineers and operates Zscaler DLP controls, and contributes to compliance, documentation, and stakeholder delivery. It is a hybrid position in the DC Metro area. Candidates must be U.S. citizens and obtain and maintain DHS/USCIS suitability (Public Trust); an active clearance is a plus.

Requirements

Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, or a related field; four additional years of relevant experience may substitute.
At least 10 years of IT or cybersecurity experience, including at least five years focused on data security, data governance, or DLP.
Hands-on experience designing and tuning an enterprise DLP platform across at least two channels (web, endpoint, email, or SaaS). Zscaler is preferred; Symantec/Broadcom, Forcepoint, Microsoft Purview, Netskope, or Palo Alto are acceptable.
Working knowledge of Databricks (Unity Catalog, access controls, tagging, and audit) or an equivalent lakehouse/data catalog platform such as Snowflake, AWS Lake Formation, or Microsoft Purview Data Map.
Demonstrated experience with data classification and labeling, including sensitivity schemes, PII/SPII handling, CUI, and EDM/IDM fingerprinting.
Working knowledge of the CISA Zero Trust Maturity Model, NIST SP 800-207, and NIST SP 800-53 Rev. 5.
Experience on a federal program involving RMF/ATO, FISMA, and SIEM log integration; Splunk is preferred.
AWS cloud security fundamentals, including S3/RDS/KMS encryption, IAM, and CloudTrail.
Strong technical writing skills and ability to produce client-ready assessments and brief government leadership.
U.S. citizenship and ability to obtain and maintain DHS suitability.

Nice To Haves

Prior DHS experience, ideally with USCIS or another immigration/benefits component, and familiarity with DHS 4300A.
Zscaler certifications (ZDTA, ZDTE, or the Zscaler Data Protection specialist track) or experience delivering a Zscaler DLP rollout to 10,000 or more users.
Databricks certification, such as Data Engineer Associate/Professional or Platform Administrator.
Security certification such as CISSP, CCSP, CISM, or CDPSE; a CDMP data governance credential is a plus.
Experience migrating from a legacy DLP or insider-risk toolset to an SSE/SASE platform.
Exposure to DSPM tooling, GenAI data controls, or post-quantum cryptography inventory work.
Active clearance.

Responsibilities

Own the agency data-pillar maturity baseline against CISA ZTMM v2.0 and maintain requirements, KPIs, and tier exit criteria for all eight data functions.
Conduct evidence-based maturity assessments by defining scoring rules, collecting dated artifacts, distinguishing owned, shared, and inherited controls, and defending scores with system owners.
Translate the maturity roadmap into sequenced work packages, milestone gates, and measurable targets.
Lead a data-source census to establish an authoritative denominator for coverage metrics.
Assess and harden data protection on the Databricks lakehouse, including Unity Catalog governance, fine-grained row and column access, tagging, lineage, audit logs, and secrets management.
Work with the data platform team on encryption at rest and in transit, key management, and data availability and recovery evidence.
Map source-system feeds to data categories and sensitivity, and drive tag-based access policy from RBAC toward ABAC.
Partner with the Chief Data Officer and data stewards on classification, ownership, and a Data Governance Working Group.
Design and tune Zscaler data protection policies across Inline Web and Private App DLP, Endpoint DLP, outbound Email DLP, CASB/SaaS API scanning, GenAI DLP, and Device Control.
Build DLP dictionaries and engines, including EDM, IDM, and OCR fingerprinting for agency identifiers.
Translate legacy DLP rules into Zscaler equivalents, and run monitor-then-enforce pilots and parallel operations.
Integrate DLP telemetry with the SIEM using Splunk via NSS/log streaming and connect it to incident workflows, including ICAP, incident receiver, and workflow automation; co-author SOC playbooks.
Support Exchange Online mail-flow integration, TLS/SSL inspection decisions, and endpoint-client prerequisites with the owning teams.
Map data controls to NIST SP 800-53 Rev. 5 (AC, AU, MP, SC, and SI families), DHS 4300A, and OMB M-21-31 logging requirements; support RMF/ATO artifacts.
Contribute to post-quantum cryptography inventory and data-at-rest cryptographic posture as they relate to the data pillar.
Write and brief maturity reports, decision memos, runbooks, RACI documents, and change requests for government leads.
Run working sessions with security policy, cloud infrastructure, SOC, data platform, and privacy stakeholders.