Top Senior Cyber Security Jobs in Washington, DC

Serve as senior ISSO to lead cybersecurity risk management, A&A, FISMA compliance, continuous monitoring, and secure cloud/hybrid engineering using NIST and CNSSI controls and RMF principles.

Lead product security reviews, perform manual code and penetration testing, threat model and assess AI/LLM-integrated architectures, drive incident response and remediation, build security automation tools, mentor engineers, and publish security research.

Serve as a Principal SOC Analyst supporting federal cyber missions. Requires 5+ years experience, technical training or degree, required IAT II/CSSP/GMON/SCCU certifications, active Top Secret/SCI clearance and ability to obtain a polygraph. Work onsite supporting SOC operations, threat monitoring, and incident response.

Manage full lifecycle RMF/DIACAP Assessment & Authorization activities to support Authorization to Operate (ATO). Conduct security assessments, maintain risk registry, support vulnerability scanning and patch management, produce A&A documentation, and provide technical guidance on mitigation and configuration management.

Lead and oversee cybersecurity and system security compliance for mission systems. Collaborate with cross-functional teams, analyze operational challenges, recommend improvements, and produce documentation, reports, and deliverables to support continuous improvement and mission objectives.

Design, implement, and maintain secure Azure Government cloud architectures; enforce zero-trust and RBAC; configure Azure security controls; automate compliance with IaC and scripting; integrate SIEM/SOAR for monitoring and incident response; conduct vulnerability assessments and manage POA&Ms; support ATO/RMF processes and produce security documentation and SSPs; liaise with mission owners, assessors, and compliance teams to maintain ongoing federal compliance.

Serve as the primary ISSO for enterprise infrastructure across classified domains: manage security lifecycle, maintain ATOs, update authorization packages, run continuous monitoring, develop POA&Ms and waivers, ensure STIG and NIST/FISMA compliance, audit logs, coordinate remediation and secure decommissioning, and collaborate with engineering and system owners to sustain secure operations.

Perform comprehensive RMF/JSIG-based security assessments for Collateral, SCI, and SAP systems; evaluate controls, prepare SARs and POA&Ms, advise AOs/ISOs, support authorization decisions, continuous monitoring, incident and compliance support, and review SDLC impact on authorization boundaries.

Lead FedRAMP ATO planning and execution for SAP Concur and aligned SaaS platforms, develop and maintain SSPs/POA&Ms per NIST guidance, coordinate with GSA and agency ISSOs, perform continuous monitoring and controls assessments, evaluate vendor security, support audits and remediation, and advise on secure cloud architecture and configuration baselines to sustain authorization.

Design, implement, and operate AWS cloud security and infrastructure: least-privilege IAM, network segmentation, multi-account governance, detection and response, vulnerability management, HIPAA compliance, and embedding security into the development lifecycle. Build automated remediation pipelines, maintain GitHub CI/CD automation, validate SIEM logging, and produce prioritized gap analyses for active care programs.

Senior technical responder for application security incidents: lead escalations, analyze attacks and logs, design/implement custom security policies, perform forensics, automate ASR workflows, mentor engineers, and collaborate with customers and cross-functional teams to remediate threats and improve products.

Design, implement, and validate cloud security architectures for Intelligence Community systems. Support RMF assessments, create and evaluate security documentation, advise on security doctrine, recommend tools, and implement cloud-native and IaC solutions. Work hands-on with clients to ensure compliance and secure mission-critical environments.

Design, implement, and assess cloud security architectures for intelligence community systems. Develop and evaluate security documentation, perform RMF assessments, recommend and deploy cloud security tools (on-prem, cloud, hybrid), and support accreditation. Collaborate with stakeholders, codify security procedures, and implement infrastructure-as-code solutions to meet mission requirements.

Lead offensive security engagements including internal/external network, web app, wireless, social engineering, red/purple teaming. Test IT and application controls, provide remediation recommendations, map findings to frameworks (NIST, CIS), present to stakeholders, mentor junior staff, and contribute to practice development and client program execution.

Lead assessment and secure adoption of AI/ML and GenAI systems for clients. Design security patterns and controls, perform assessments and pen tests, prototype AI-enabled security capabilities, ensure compliance (PII, privacy, regulatory), document protocols, and collaborate with cross-functional teams to productionize scalable AI-security solutions.

Lead multicloud cloud security architecture across AWS, Azure, and GCP. Develop enterprise security standards, governance models, and reference architectures. Guide engineering teams on secure-by-design implementations, IaC patterns, networking, identity, telemetry, and compliance. Conduct architecture reviews and advance scalable, compliant cloud environments for intelligence-community systems.

Lead and grow an Application Security practice: define standards, assess application security posture, advise on secure-by-design architectures, integrate AI scanning, lead teams of engineers/architects, drive remediation, and support business development and sales for application security services.

Design, implement, and automate enterprise information-protection, DLP, insider-risk, retention, and records-management controls across Microsoft 365 and GovCloud. Build SITs, sensitivity labels, label-driven encryption, and Purview automations; implement Conditional Access, RBAC, eDiscovery, audit investigations, and endpoint safeguards while mentoring and coordinating with Navy stakeholders and cloud teams.

As a Security Architect, you will build secure agent runtimes and systems, ensuring robust security capabilities in agentic AI solutions while conducting security evaluations.

Sell Mitiga's runtime security platform to enterprise CISOs and security leaders. Manage end-to-end enterprise sales cycles from prospecting to close, build strategic territory and partner plans, collaborate with solutions engineering and customer success, and maintain accurate CRM records while consistently exceeding revenue targets.

Lead and perform HITRUST Gap, Readiness, and Validated Assessments. Define scope, test controls, validate evidence in MyCSF, produce readiness and validated reports, advise clients on remediation, and ensure compliance with HITRUST methodology and related frameworks.

Lead security across applications, services, infrastructure, and developer workflows. Identify, assess, and mitigate risks; run secure code reviews, threat modeling, and architecture discussions; build automation and tooling to prevent issues; harden authentication and access control; investigate incidents and manage disclosures; partner with engineering teams to design secure-by-default APIs and deployments.

Lead customer security strategy and architecture using Microsoft security products. Assess security posture, design cloud-native solutions, remove technical blockers, author customer insights, and support complex enterprise deployments to accelerate adoption and secure cloud/hybrid environments.

Lead deep technical security reviews of products and platforms, produce prioritized remediation roadmaps, build security tools and automations, integrate guardrails and automated checks, partner with product teams to implement and validate fixes, and use threat intelligence and telemetry to convert attack paths into controls and detections.

Lead security assessments and controls across cloud-hosted applications, APIs, mobile (Flutter), CI/CD, and infrastructure. Implement and harden shared security tooling (dependency/secret/static/container scanning), review IAM and privileged access, support incident readiness and monitoring, evaluate SRE/recovery changes for security impact, and coordinate remediation with system owners. Establish security policies, automation, and review triggers to integrate practical controls into engineering workflows.