Company Description

Job Description

Scope of Responsibilities

• Run Daily Security Operations: Monitor alerts across our environment—Google Workspace, CrowdStrike (endpoint/EDR), cloud, and network—triage what matters, and drive issues to resolution. Tune tooling to reduce noise and keep focus on real threats.
• Own Incident Response: Lead the complete IR lifecycle (triage, investigation, containment, eradication, and recovery). Build and exercise playbooks, run tabletops, lead active response efforts, and feed lessons learned back into security controls.
• Own Vulnerability Management: Run scanning, prioritization, and remediation tracking across endpoints, servers, and cloud environments. Partner closely with IT to drive actual remediation, not just issue reports.
• Execute Security-Focused IT Engineering: Configure and harden endpoints, identity/access systems, and cloud/SaaS platforms. Support secure system administration, onboarding/offboarding controls, MDM, and the operational foundation of our security posture.
• Build Program Operational Muscle: Under the Director’s guidance, establish and mature the processes, runbooks, and tooling required to keep us aligned with CMMC / NIST 800-171 standards and CUI obligations.
• Automate Toil: Script repetitive work (enrichment, response actions, reporting, provisioning) using Python or equivalent languages so the security program scales efficiently.
• Document & Level Up the Organization: Create clear runbooks and documentation while actively raising the overall security IQ of the broader team.

Qualifications

• U.S. Citizenship is required
• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or related field

• Experience: 6–10 years of hands-on technical experience with a primary focus in Security Operations and Incident Response, supported by strong IT and systems engineering fundamentals. Must possess experience with CrowdStrike.
• SecOps & IR Proficiency: Proven track record running end-to-end incident response (monitoring, triage, investigation, containment, and recovery) in production environments.
• IT & Cloud Security Engineering: Solid grasp of endpoint administration, identity and access management (IAM), MDM, and secure configuration of modern cloud/SaaS environments. Direct experience with Google Workspace and CrowdStrike (or equivalent EDR) is strongly preferred.
• Automation & Scripting: Practical scripting capability (Python or equivalent) used to automate manual processes and operational tasks.
• Vulnerability Management: Working knowledge of vulnerability scanning tools, risk prioritization, and collaborating across teams to drive remediation.
• Execution Mindset: Strong builder’s mentality with the ability to turn strategic roadmaps into functional systems, workflows, and documentation.
• Communication: Clear written and verbal communication skills, capable of explaining technical security risks to both engineering teams and leadership.
• Clearance Eligibility: U.S. citizenship and the eligibility to obtain and maintain a U.S. government security clearance.

• Defense / Compliance Exposure: Experience in defense or government contracting environments, including familiarity with CMMC, NIST 800-171 / NIST 800-53, and CUI handling procedures.
• Greenfield Build Experience: Prior experience standing up a security operations capability or IR program from an early stage.
• CrowdStrike Certifications: Direct experience with the CrowdStrike Falcon platform is required. Active CrowdStrike certifications—such as CCFA (Administrator), CCFR (Responder), CCFH (Hunter), CCFP, or specialized cloud/identity certs (CCCS / CCIS)—are highly desired.
• Security Certifications: Industry certifications such as GCIH, GCFA, Security+, CySA+, GSEC, or CISSP (valued, but secondary to practical hands-on experience).
• Clearance: Active or current U.S. government security clearance.