Jobs at cFocus Software Incorporated

Directs delivery of a federal cybersecurity services contract, overseeing staffing, schedules, risks, quality, SLAs, finances, reporting, governance, and stakeholder coordination. Maintains program, communications, staffing, transition, and risk-management plans; supports cybersecurity authorization, continuous monitoring, audit readiness, and incident coordination. Produces recurring performance reports and executive briefings while coordinating with federal officials, technical teams, auditors, subcontractors, and security stakeholders. Requires active Public Trust clearance, PMP certification, and extensive federal IT or cybersecurity program-management experience.

Develop, maintain, and deploy custom geospatial and situational-awareness applications for DHS using C#, .NET, ESRI technologies, Python notebooks, and cloud infrastructure. Integrate APIs and enterprise systems, implement automated tests and DevSecOps practices, support deployments across environments, ensure accessibility and security compliance, and produce documentation and test artifacts.

Support DHS program testing for geospatial, web, cloud, and enterprise systems. Develop risk-based test strategies, plans, manual and automated tests, traceability, test data, and execution evidence. Validate APIs, integrations, .NET/Python/JS components, ArcGIS capabilities, accessibility, security, and performance. Maintain automation in GitLab, execute tests across environments, and coordinate with security and operations to ensure compliance with DHS requirements.

Support DHS geospatial mission by ingesting, processing, validating, and maintaining GIS datasets; produce web maps, hosted layers, dashboards, and metadata; perform QA/QC, spatial analysis, and geoprocessing; document data lineage; support testing, Agile workflows, and configuration using ESRI tools and government-approved repositories.

Manage and coach Agile software, data, cloud, and geospatial teams for DHS. Oversee scope, schedule, cost, risks, requirements, backlogs, and delivery; facilitate ceremonies; maintain Jira/Confluence artifacts; coordinate stakeholders, subcontractors, and federal governance; track staffing, security, and program controls.

Provide programmatic support to DHS GMO managing enterprise geospatial data and applications. Lead or support teams to implement geospatial IT solutions, develop policies and GII requirements, prioritize resources, apply Agile/Waterfall methodologies, and deliver tactical and strategic recommendations. Maintain DC business-hour availability and respond to technical issues within 24 hours.

Lead enterprise geospatial architecture for DHS: develop current/target-state architectures, assess environments, perform gap analyses, recommend standards and roadmaps, integrate Esri/AWS solutions, ensure SELC/FISMA/IPv6/Section 508 compliance, guide DevSecOps and verification, mentor teams, and oversee deployments, operations, and technical evaluations.

Act as the principal ISSO for DHS geospatial systems: maintain SSPs, implement and assess NIST controls, run ISCM, coordinate authorization (ATO/ATC), remediate vulnerabilities, advise system owners, and manage security documentation and reporting.

Serve as Scrum Master for DHS geospatial teams, enforcing Agile/Scrum, improving processes, managing Custom and COTS development, and providing programmatic and geospatial subject-matter guidance to prioritize and implement GII requirements.

Lead and manage 24x7x365 SOC operations for the AOUSC, overseeing alert triage, incident response, containment, remediation, forensics, and post-incident reviews. Ensure adherence to NIST and ITIL standards, manage SOC staff and operational metrics, maintain SOPs and work instructions, coordinate with stakeholders, provide executive and technical briefings, and support continuous improvement, onboarding, and transition activities.

Lead cyber exercises and support for AOUSC: oversee incident response operations, capacity planning, and develop/facilitate live trainings for government staff. Assess learner progress, provide real-time feedback, and collaborate with federal stakeholders in a hybrid Washington, DC role requiring Public Trust clearance.

Support AOUSC as a Detection Engineer performing proactive threat hunting and adversary emulation. Form hypotheses, query large datasets to identify APT behavior, script tools in Python and PowerShell, and develop SIEM detections using Splunk ES or Microsoft Sentinel. Hybrid role based in Washington, DC requiring an active Public Trust clearance.

Tier-2 Incident Response Analyst supporting AOUSC in a hybrid DC role. Perform live triage, log correlation, detection rule refinement, and decode/decrypt obfuscated payloads using Python and PowerShell. Use Velociraptor, Splunk ES, and Sentinel while following NIST incident handling guidance. Active Public Trust and SANS GCIH or GCIA required.

Lead proactive, hypothesis-driven threat hunts to detect APTs and insider threats across endpoint, network, cloud, identity, SIEM, and EDR telemetry. Develop hunt plans, queries, and reports; coordinate with detection engineering, threat intelligence, and incident response; mentor analysts; produce executive sprint reports; and maintain SOPs, playbooks, and telemetry/enrichment efforts for the Judiciary SOC.

Lead 24x7 SOC and MDR operations for a large federal enterprise: manage analysts, SIEM and EDR/XDR monitoring, triage, incident coordination, playbooks, reporting, metrics (MTTD/MTTR), and executive briefings. Coordinate with threat hunting, detection engineering, CTI, and incident response and support staffing, proposals, and transitions.

Manage AOUSC cybersecurity program delivery, providing program leadership, oversight of SOC services, staffing, planning, risk management, reporting, compliance with NIST/ITIL, and ensuring operational readiness across IR, forensics, threat hunting, detection engineering, and related functions.

Support AOUSC insider-threat program by performing live triage, log correlation, and detection rule refinement. Utilize Velociraptor, Splunk ES, and Sentinel, and follow NIST incident-handling guidance. Position requires an active Public Trust clearance and relevant IR/insider-threat experience.

Design, mature, and lead insider threat detection and investigative capabilities for a federal enterprise. Integrate UEBA, SIEM, EDR, DLP, and identity telemetry to detect and investigate data exfiltration, credential abuse, privilege misuse, and anomalous behavior. Coordinate with SOC, CTI, HR, legal, and counterintelligence; develop reporting, case management, dashboards, policy, and executive briefings; perform threat assessments and present findings.

Lead detection engineering for AOUSC: research, develop, test, deploy, tune, and maintain SIEM detections and RBA framework; coordinate with SOC teams, threat intel, and stakeholders; produce reports and documentation; ensure timely deployment of vulnerability-related detections.

Support AOUSC threat hunting program in a hybrid Washington, DC role. Requires active Public Trust clearance, a BS in CS/IT or related field, 3+ years proactive threat hunting/adversary emulation, experience querying large datasets to identify APT behavior, and scripting proficiency (Python, PowerShell) to develop tools.