Top Cyber Security Jobs in Washington, DC

Lead infrastructure security for GitLab’s FedRAMP and federal cloud environments. Set technical direction, architecture, security automation, and compliance patterns; own security posture; lead threat modeling, security reviews, continuous monitoring, and authorization-impacting initiatives. Partner with SRE, engineering, compliance, and leadership to drive remediation and roadmap decisions. Apply AI to constrained security workflows, mentor engineers, and influence security practices across GitLab offerings.

Conduct manual penetration tests and secure code reviews across web applications, APIs, AWS infrastructure, and AI systems. Develop AI-assisted security tooling, test LLM applications and agents, triage SAST findings, tune detection rules, support security reviews before production, and communicate risks and remediation priorities to engineering teams.

Build and scale application security for a SaaS platform by integrating SAST, SCA, DAST, secrets scanning, and container/IaC checks into CI/CD. Partner with engineering and DevOps teams on threat modeling, secure code reviews, vulnerability remediation, incident response, and secure development practices. The role also supports compliance goals and translates security risks clearly to engineers.

Design, build, and operate secure, resilient distributed systems for secrets and key management across Cloudflare's global network. Re-architect and strengthen internal PKI and machine/workload identity, support and run services (including on-call), and consult with teams to ensure secure system design and usage.

Supports IT solution design and implementation, analyzes cybersecurity protocols and recommends improvements, and collaborates with data science teams to analyze data and generate actionable insights. The internship provides hands-on experience, mentorship, professional development, and exposure to aerospace technology. Candidates must be enrolled in a relevant bachelor's or higher degree program, maintain a 3.0 GPA, and graduate in December 2027 or later.

Responsible for information assurance and cybersecurity compliance across a complex federal cloud infrastructure program. Develops and maintains RMF authorization packages, SSPs, risk assessments, POA&Ms, contingency and incident response plans, and related documentation. Conducts security control assessments, vulnerability scans, risk analyses, continuous monitoring, and incident response support. Coordinates with security stakeholders to achieve and maintain ATO, ensures FISMA compliance, validates physical safeguards, manages system inventories, and supports agency data calls.

Own and improve Onebrief’s corporate security stack across endpoints, identity, SaaS, browsers, Zero Trust, EDR, SIEM, and MDM. Establish secure configuration baselines, detect and remediate drift, integrate telemetry, and build API-driven or infrastructure-as-code automation. Translate CMMC 2.0 and NIST-aligned requirements into continuously validated technical controls and reliable audit evidence. Partner with Corporate IT, Security Operations, GRC, and application owners to strengthen security posture and reduce manual compliance work.

Design, build, and scale IAM solutions across cloud and internal systems. Implement role design and least-privilege models, automate access workflows and reviews, integrate logging/metrics into SIEM, reduce privilege sprawl, identify and mitigate risky permissions, and operationalize IAM projects end-to-end with documentation and runbooks.

Oversees information security compliance for complex federal programs involving applications, facilities, and infrastructure. Develops policies, conducts audits and risk assessments, evaluates security posture, manages compliance documentation, advises on systems security, and communicates risks and initiatives to government leadership. Collaborates with program leaders, software teams, security offices, and facility managers while supporting ISSO responsibilities and delivering consulting solutions.

Sets application security direction and standards across engineering teams. Builds scalable security tooling, automation, and observability; leads threat modeling, risk assessments, code reviews, and multi-team remediation. Develops strategies for AI-powered systems and agentic development risks, API security, and software supply chain security. Partners with engineering and security teams, prioritizes investments, communicates risk to leadership, and mentors AppSec engineers.

Oversee cybersecurity and Information Assurance requirements for classified DoD and Intelligence Community systems. Manage RMF and ICD 503 compliance, Assessment and Authorization documentation, system security plans, assessments, POA&Ms, continuous monitoring, and risk remediation. Coordinate with technical, security, program, and government stakeholders to maintain authorization throughout the system lifecycle and provide cybersecurity guidance to leadership.

Provides cybersecurity engineering and Information Assurance support for DoD and Intelligence Community systems. Integrates security controls into system architectures, supports RMF and ICD 503 Assessment and Authorization activities, develops security documentation, performs continuous monitoring, and advises leadership on security risks and mitigations. Requires active TS/SCI clearance, 5+ years of relevant experience, DoD or IC expertise, and knowledge of NIST, CNSSI, and cybersecurity compliance frameworks.

Design, implement, and assess cloud security architectures for intelligence community systems. Develop and evaluate security documentation, perform RMF assessments, recommend and deploy cloud security tools (on-prem, cloud, hybrid), and support accreditation. Collaborate with stakeholders, codify security procedures, and implement infrastructure-as-code solutions to meet mission requirements.

Provides expert security support for SCI operations, including SCIF access control, personnel indoctrination and debriefing, courier badging, NDA administration, classified-material audits, facility inspections, crisis surge planning, stakeholder coordination, policy recommendations, reports, and technical assessments. The role requires active TS/SCI clearance with polygraph eligibility and onsite customer support in Washington, DC.

The Intermediate ISSO supports FEMA cybersecurity compliance by executing Risk Management Framework activities, implementing security controls, conducting vulnerability and system assessments, and maintaining SSPs, POA&Ms, configuration management, and contingency plans. The role supports continuous monitoring, cloud security, audit documentation, change reviews, FISMA compliance, and cybersecurity reporting. It requires coordination with system owners, ISSOs, stakeholders, and leadership while ensuring adherence to DHS and NIST requirements.

Leads vulnerability remediation and cybersecurity risk management for federal information systems. Oversees RMF lifecycle activities, system categorization, security controls, assessments, authorization documentation, continuous monitoring, incident response, audit support, and compliance reporting. Supervises security professionals, advises stakeholders and leadership, supports DOJ and Intelligence Community data calls, and drives security process improvements. Requires an active TS/SCI clearance and ability to obtain a polygraph.

Conduct security control assessments for federal information systems under the NIST RMF, supporting authorization and continuous monitoring activities. Develop assessment plans and test cases, evaluate technical and operational safeguards, review vulnerability and compliance scan results, identify false positives and residual risk, and document actionable findings. Prepare Security Assessment Reports and authorization briefings while communicating risk to technical teams, system owners, and stakeholders.

Leads federal cybersecurity, privacy, and GRC activities across the NIST RMF lifecycle. Responsibilities include ATO support, authorization package development, risk assessments, vulnerability analysis, continuous monitoring, remediation tracking, privacy compliance, incident response, contingency planning, audit support, and stakeholder advising. The role requires producing audit-ready documentation and coordinating security and privacy initiatives with government and technical teams.

Leads a 12-person application security practice conducting code audits, vulnerability research, and secure design reviews. Oversees technical delivery, client relationships, project staffing, utilization, profitability, recruiting, and team development. Provides hands-on technical direction across source-code security work, determines investments in tooling and methodologies, and integrates AI-assisted auditing and research into team workflows. The role also owns practice P&L and supports engineers’ conference, publication, and open-source contributions.

The Information Security Engineer will secure Palantir's Windows and Active Directory environment, focusing on attack surface reduction, tooling deployment, automation for security operations, and incident response.

The Forward Deployed Security Engineer manages government cybersecurity projects, achieving ATOs, translating regulations into technical requirements, and providing expertise during audits. Role involves collaboration with stakeholders and policy interpretation.

As a Senior Identity Security Engineer, you'll oversee identity security infrastructure, architect authentication systems, and lead identity threat modeling, while collaborating with engineering teams on governance and policy enforcement.

The Defensive Security Analyst protects Palantir's infrastructure by managing SOC systems, developing detection strategies, conducting forensics, and leading incident response efforts.

The Information Security Engineer will safeguard Palantir's infrastructure, focusing on threat detection, incident response, and collaboration within the security team to protect global operations.

The Insider Threat Detection Engineer protects data and assets by detecting and investigating insider threats, automating workflows, and developing security strategies.