Jobs at cFocus Software Incorporated

Serve as Scrum Master for DHS geospatial teams, enforcing Agile/Scrum, improving processes, managing Custom and COTS development, and providing programmatic and geospatial subject-matter guidance to prioritize and implement GII requirements.

Lead and manage ISSO activities for the DFC program: serve as primary technical interface with government stakeholders, oversee authorization packages and ATO support, manage risk and issue registers, lead contractor ISSO team, ensure consistent execution and quality control, and maintain hands-on cybersecurity expertise.

Manage and deliver IT projects for a DIA program on-site in the DC/MD/VA area. Develop project plans, manage resources, budgets, schedules, risks, and stakeholder communications. Prepare status reports, ensure compliance with PM standards, and track contract deliverables to meet scope, schedule, and budget objectives.

Lead and perform senior ISSO duties supporting DFC systems: manage RMF/ATO activities, continuous monitoring, vulnerability management, POA&M, audit support, FISMA compliance, and produce cybersecurity documentation and executive reporting. Maintain proficiency with DFC tools (ServiceNow, CSAM, Splunk, vulnerability scanners).

Support AOUSC as a Detection Engineer performing proactive threat hunting and adversary emulation. Form hypotheses, query large datasets to identify APT behavior, script tools in Python and PowerShell, and develop SIEM detections using Splunk ES or Microsoft Sentinel. Hybrid role based in Washington, DC requiring an active Public Trust clearance.

Lead cyber exercises and support for AOUSC: oversee incident response operations, capacity planning, and develop/facilitate live trainings for government staff. Assess learner progress, provide real-time feedback, and collaborate with federal stakeholders in a hybrid Washington, DC role requiring Public Trust clearance.

Lead and manage 24x7x365 SOC operations for the AOUSC, overseeing alert triage, incident response, containment, remediation, forensics, and post-incident reviews. Ensure adherence to NIST and ITIL standards, manage SOC staff and operational metrics, maintain SOPs and work instructions, coordinate with stakeholders, provide executive and technical briefings, and support continuous improvement, onboarding, and transition activities.

Tier-2 Incident Response Analyst supporting AOUSC in a hybrid DC role. Perform live triage, log correlation, detection rule refinement, and decode/decrypt obfuscated payloads using Python and PowerShell. Use Velociraptor, Splunk ES, and Sentinel while following NIST incident handling guidance. Active Public Trust and SANS GCIH or GCIA required.

Lead proactive, hypothesis-driven threat hunts to detect APTs and insider threats across endpoint, network, cloud, identity, SIEM, and EDR telemetry. Develop hunt plans, queries, and reports; coordinate with detection engineering, threat intelligence, and incident response; mentor analysts; produce executive sprint reports; and maintain SOPs, playbooks, and telemetry/enrichment efforts for the Judiciary SOC.

Lead 24x7 SOC and MDR operations for a large federal enterprise: manage analysts, SIEM and EDR/XDR monitoring, triage, incident coordination, playbooks, reporting, metrics (MTTD/MTTR), and executive briefings. Coordinate with threat hunting, detection engineering, CTI, and incident response and support staffing, proposals, and transitions.

Manage AOUSC cybersecurity program delivery, providing program leadership, oversight of SOC services, staffing, planning, risk management, reporting, compliance with NIST/ITIL, and ensuring operational readiness across IR, forensics, threat hunting, detection engineering, and related functions.

Support AOUSC insider-threat program by performing live triage, log correlation, and detection rule refinement. Utilize Velociraptor, Splunk ES, and Sentinel, and follow NIST incident-handling guidance. Position requires an active Public Trust clearance and relevant IR/insider-threat experience.

Lead detection engineering for AOUSC: research, develop, test, deploy, tune, and maintain SIEM detections and RBA framework; coordinate with SOC teams, threat intel, and stakeholders; produce reports and documentation; ensure timely deployment of vulnerability-related detections.

Design, mature, and lead insider threat detection and investigative capabilities for a federal enterprise. Integrate UEBA, SIEM, EDR, DLP, and identity telemetry to detect and investigate data exfiltration, credential abuse, privilege misuse, and anomalous behavior. Coordinate with SOC, CTI, HR, legal, and counterintelligence; develop reporting, case management, dashboards, policy, and executive briefings; perform threat assessments and present findings.

Support AOUSC threat hunting program in a hybrid Washington, DC role. Requires active Public Trust clearance, a BS in CS/IT or related field, 3+ years proactive threat hunting/adversary emulation, experience querying large datasets to identify APT behavior, and scripting proficiency (Python, PowerShell) to develop tools.

Perform cyber threat intelligence analysis and advisory support: analyze data needs and quality, conduct in-depth technical analysis of telemetry to identify patterns, trends, IOCs and TTPs, and collect/aggregate threat intelligence from OSINT, dark web forums, and commercial feeds. Hybrid role in Washington, DC requiring an active Public Trust clearance.

Conduct digital forensic examinations of disk, memory, and registry; perform artifact analysis (SRUM, Shellbags, Prefetch); use Axiom, EnCase, FTK, X-Ways, Volatility; follow federal evidence guidelines and chain-of-custody procedures. Hybrid role supporting AOUSC with onsite presence in Washington, DC and requires Public Trust clearance.

Lead CTI, detection engineering, and threat hunting operations. Develop intelligence-driven detections, hunt playbooks, SIEM/analytics content, and SOAR integrations. Conduct hypothesis-based hunts aligned to MITRE ATT&CK, analyze malware and adversary campaigns, produce threat intelligence reporting, and brief executives on emerging threats and operational risk.

Write and maintain cybersecurity documentation for AOUSC, including SOPs, incident response playbooks, and after-action reports. Ensure artifacts align with federal standards (NIST 800-53, RMF, CSF). Work hybrid in Washington, DC and hold an active Public Trust clearance and Security+ certification.

Manage DIA IT projects on-site: plan, execute, and deliver within scope, schedule, and budget; develop plans, track milestones, manage risks, stakeholders, budgets, and contract deliverables; produce status reports and ensure PM compliance.