Top Senior Cyber Security Jobs in Washington, DC

Lead enterprise security risk assessments, maintain the risk register, prioritize and track remediation, evaluate vendor and architectural risks, define risk methodologies, map controls to NIST and CMMC requirements, support audits, report risk metrics to leadership, and promote risk ownership across the organization.

Secure Wiz’s products, CI/CD systems, and production cloud infrastructure through threat modeling, security reviews, vulnerability management, detection and response, cloud and Kubernetes security baselines, policy-as-code, and automation. Partner with engineering, DevOps, operations, and Federal teams to implement scalable security controls, remediate risks, support FedRAMP requirements, and promote secure-by-design development practices.

Designs, implements, and manages AWS cloud security policies, architecture, and technologies. The role oversees firewalls, DLP, vulnerability scanning, monitoring, logging, IAM, incident response, compliance, and remediation. It provides security guidance for AWS solutions, supports migrations of mission-critical applications, researches new technologies, documents standards, presents to varied audiences, and mentors less experienced engineers. The position requires strong AWS expertise, infrastructure-as-code proficiency, knowledge of regulated healthcare environments, and experience securing highly available cloud and serverless architectures.

Own security partnerships for Netflix Marketing and Animation, advising leaders on risk, GenAI adoption, access controls, content protection, architecture, and remediation. Lead risk assessments, business risk profiles, metrics, and pre-release content security initiatives. Support technical security due diligence for acquisitions and subsidiaries while translating complex security concerns into actionable business guidance across application, cloud, identity, and data domains.

Supports cybersecurity risk management and authorization for the VA.gov Platform. Assesses NIST security controls, performs gap and risk analyses, maintains SSPs, POA&Ms, and authorization evidence, and translates deficiencies into engineering remediation. The role supports ATO/cATO readiness, OSCAL automation, threat modeling, secure design reviews, stakeholder coordination, incident response, and continuous synchronization between technical changes and security documentation.

Build and operate infrastructure security platforms centered on workload identity, service-to-service authentication, authorization, and short-lived credentials. Replace static secrets with identity-based systems, develop identity-authenticated proxies and APIs, and unify authorization policy management. Partner with platform and application teams to drive adoption, migrate legacy systems, and ensure reliable production infrastructure with strong developer experience.

Lead secure design and code reviews, conduct penetration testing and code audits, build secure-by-default systems, improve security tooling and vulnerability management, operate responsible disclosure programs, remediate production vulnerabilities, and address customer security concerns. The role partners closely with engineering teams and requires strong coding, risk assessment, offensive security, and security communication skills.

Provides security engineering and architecture expertise for FedRAMP authorization and continuous monitoring. Reviews cloud service provider architectures, security controls, authorization packages, assessment reports, vulnerabilities, and compliance documentation against NIST, FedRAMP, FISMA, RMF, and agency requirements. Leads vendor interviews, identifies technical and documentation gaps, advises government program leads and CISOs on risk posture, and supports secure, compliant, resilient system design.

Owns broad product and operational security responsibilities, including identity and access management, threat modeling, code review, fuzzing, bug bounty operations, AI security research, software supply chain monitoring, penetration test coordination, and compliance evidence. The role requires a strong software engineering background, product security expertise, security tooling development, systems programming experience, and familiarity with web3 or DeFi. It is remote-first and emphasizes autonomy, documentation, and high ownership.

Lead corporate endpoint security architecture with a focus on macOS, designing secure-by-default controls, automation, patching, software distribution, and security baselines across macOS, iOS, Windows, and Linux. Manage configurations through Terraform, GitOps, version control, CI pipelines, and automated rollouts. Partner with IT and security teams to improve telemetry, detection, response, auditability, and operational efficiency. Mentor engineers and serve as a senior escalation point for complex endpoint security issues in a fully remote environment.

Lead independent security assessments and authorization activities for federal cloud, hybrid, and enterprise systems. Evaluate Azure and AWS security controls, FedRAMP packages, inherited controls, vulnerabilities, architectures, and technical evidence. Produce assessment plans, reports, risk assessments, evidence requests, and POA&Ms. Communicate findings and mitigation recommendations to technical teams, system owners, executives, and stakeholders while supporting consistent, defensible cybersecurity assessment practices.

Build backend services and distributed systems for a cybersecurity and software supply chain security platform. Develop scalable APIs, data pipelines, and platform components handling vulnerability, container, package, runtime, and SBOM data. Work across Linux, Kubernetes, containers, and cloud environments while solving concurrency, performance, reliability, and distributed processing challenges. Own projects from design through deployment, participate in architecture discussions, review code, and collaborate with security researchers and product teams.

Leads cybersecurity professionals implementing the Risk Management Framework for federal IT systems. Oversees system categorization, security control selection and assessment, authorization documentation, continuous monitoring, risk analysis, remediation, incident response, audit support, and stakeholder training. Advises leadership on cybersecurity risks and compliance while maintaining alignment with NIST guidance and DoD requirements.

Advise and lead cybersecurity risk management activities for cloud and federal systems, including system categorization, security control selection, implementation oversight, assessments, authorization documentation, continuous monitoring, incident response, remediation, audits, and stakeholder training. Maintain compliance with RMF, NIST guidance, and DoD requirements while reporting security risks and improvement opportunities to leadership.

Designs and presents Qualys security solutions for federal enterprise customers, supporting technical sales engagements, proofs of concept, architecture workshops, compliance programs, and post-sale deployment health checks. Advises customers on vulnerability, asset, patch, cloud, application, and threat security while partnering with sales, product, marketing, and strategic partners. Authors technical content, enables field teams, and travels to customer locations at least 30% of the time.

Supports federal cybersecurity programs by implementing and assessing NIST security controls, managing RMF authorization activities in eMASS, developing security documentation, and maintaining POA&Ms. The role coordinates STIG remediation, conducts risk assessments, monitors incidents, and communicates security requirements to technical and nontechnical stakeholders. Requires extensive ISSO or security engineering experience, advanced cybersecurity certification, familiarity with security tools, and an active TS/SCI clearance with the ability to obtain a polygraph.

Supports security operations and SIEM administration for Department of State IT environments. Develops secure installation guides aligned with federal standards and DISA STIGs, configures and manages SIEM processes and tools, implements security solutions for threats and vulnerabilities, and performs patch management and security update operations to maintain compliance.

Leads a 10-person security operations team supporting Department of State IT systems. Responsibilities include security monitoring, incident response, vulnerability and cyber hygiene assessments, POA&M remediation, patching, centralized logging, A&A and ATO support, security architecture, risk mitigation, asset management, and compliance with government security standards. The role also coordinates engineers, project managers, stakeholders, and personnel training while supporting secure government environments.

Designs, implements, maintains, and evolves firewall and network security systems supporting a global Department of State network. Troubleshoots complex firewall-related incidents, evaluates security products and configurations, develops upgrade plans, coordinates with vendors and the CISO, and serves as a senior escalation point for administrators and technicians. The role also documents security elements, researches emerging threats, approves technical solutions, and provides guidance to junior staff.

Provides multidisciplinary information assurance and cybersecurity leadership for a Department of Defense client. Responsibilities include supporting vulnerability management, penetration testing, corrective actions, NIST RMF and security control implementation, STIGs, SCAP, IAVAs, FISMA, defensive cyber operations, incident response, reporting, recovery, and complex DoD project management. Requires extensive DoD IA experience, an approved Level 3 cybersecurity certification, and a favorably adjudicated NACI investigation.

Lead and mature Affirm's third-party security risk program by designing controls, automating GRC workflows, evaluating third-party/cloud security, building integrations and dashboards, and advising stakeholders. Drive automation using Python and agentic coding tools, operate orchestration across systems, manage a portfolio of risk reviews, and establish metrics, processes, and reporting to scale security risk management.

Owner of Vannevar's authentication and authorization platform: build tenant-isolated auth systems, self-service user/group/permission admin UI, tooling to visualize and validate access, feature-flag and platform management interfaces, and shared authorization capabilities across products.

The Security Engineer will manage Liftoff's SIEM, lead the adoption of AI-augmented SOC tools, triage alerts, and improve incident response processes while collaborating on various security functions.

Lead and grow a Security Platform engineering team to design and operate centralized identity and access services (IdP integrations, SSO, authorization frameworks). Define roadmap, partner cross-functionally, and drive adoption of secure-by-default access controls across products.

Manages enterprise information security governance, risk, and compliance initiatives. Develops security policies and frameworks, leads data classification and threat modeling, conducts risk assessments, oversees vulnerability remediation, evaluates security controls, supports audits, and prepares risk metrics and executive reports. Partners with technical teams to embed security requirements and promotes governance best practices across the organization.