Top Cyber Security Jobs in Washington, DC

Leads cybersecurity accreditation and authorization activities for government systems. Documents security controls, architectures, SSPs, CONOPS, contingency plans, user guides, SOPs, and POA&M mitigations. Coordinates with system owners, project managers, engineers, contractors, and customer security organizations to secure ATD, IATT, and ATO approvals. Monitors project status, supports audits and compliance oversight, updates security plans based on emerging threats and policy, and recommends process improvements.

Conduct advanced application security research across GitLab’s DevSecOps and AI-powered platforms. Identify and exploit novel, systemic, and chained vulnerabilities; develop proof-of-concept exploits, testing methodologies, and research automation; assess AI attack vectors and open-source dependencies; drive remediation and security improvements; advise engineering teams, contribute to roadmaps, mentor researchers, and share findings with the security community.

Conducts advanced application security research across GitLab’s DevSecOps and AI-powered platforms. Responsibilities include discovering and exploiting systemic vulnerabilities, penetration testing, developing proof-of-concept exploits, researching AI and agentic security threats, building automated research tooling, coordinating remediation, mentoring security professionals, and communicating findings to engineering and security communities.

Establish and operationalize DHS OIG data governance and cybersecurity authorization frameworks for AI and analytics platforms. Responsibilities include developing governance policies, metadata standards, stewardship workflows, RBAC designs, data lineage, SSPs, POA&Ms, architecture documentation, privacy inputs, and continuous monitoring evidence. The role supports ATO processes, NIST/FedRAMP compliance, AI governance, data quality assessments, and protection of sensitive investigative and law-enforcement data in Azure Government environments.

Designs and maintains security controls for AI platforms, data environments, applications, and cloud infrastructure supporting DHS OIG. Responsibilities include RBAC, encryption, logging, SIEM integration, security monitoring, vulnerability assessments, penetration testing coordination, secure code review, ATO support, NIST and FedRAMP compliance, incident response, forensic analysis, and security documentation. The role requires Azure cloud security expertise, federal cybersecurity experience, and the ability to obtain DHS/EOD clearance.

Assess and document cybersecurity controls across federal information systems, coordinate remediation with system stakeholders, and oversee RMF activities throughout the system authorization lifecycle. Guide categorization, control selection, implementation, assessment, continuous monitoring, risk documentation, audit support, and incident response. Serve as a senior technical cybersecurity advisor, communicate risks and metrics to leadership, and provide security guidance and training while maintaining alignment with NIST and DoD requirements.

Performs IT general controls testing, control design and effectiveness assessments, financial systems security assessments, benchmarking, remediation planning, and compliance evaluations. Supports NIST, DHS, OMB, DISA, and federal internal-control requirements while collaborating with technical teams and stakeholders. Reports security risks and mitigation strategies, assists with annual ITGC scoping, and supports related assessments and authorizations to operate.

Manages federal information-system security authorization and Risk Management Framework activities, including FISMA-compliant security packages, POA&Ms, risk analyses, control assessments, continuous monitoring, incident response, contingency planning, inventories, vulnerability scans, and stakeholder coordination. Supports NIST, OMB, CNSS, and privacy requirements for a law-enforcement customer, while validating physical safeguards and developing assessment scripts and technical reports.

Own product and protocol security across Jito’s Solana-based products. Responsibilities include threat modeling, secure design and code reviews, deployment hardening, internal audits, onchain monitoring, bug bounty operations, remediation tracking, AI-assisted security testing, and key and asset risk management. The role requires production software engineering experience, strong application security expertise, security automation skills, and familiarity with Web3, crypto, or DeFi.

Performs cloud security engineering across AWS and GCP, including system hardening, vulnerability remediation, compliance scanning, cloud operations, security tooling, incident response, and troubleshooting across infrastructure and identity layers. Supports FedRAMP, FISMA, and NIST 800-53 environments, participates in a 24×7 on-call rotation, maintains technical documentation, communicates with customers, and mentors junior engineers.

Provides information security support for federal healthcare systems, including security architecture reviews, firewall and infrastructure initiatives, security impact assessments, mitigating controls, system security plans, SOPs, and POA&M remediation. Advises development teams and customer security organizations on federal security requirements, emerging practices such as Zero Trust and SBOM, network monitoring, authentication, and data security. The role is remote and requires passing an IHS background check for Public Trust eligibility.

Builds and operates cloud security controls across AWS, Azure, GovCloud, and other platforms. Responsibilities include IAM, encryption, secrets management, preventive and detective controls, PHI protection, logging pipelines, Terraform automation, security remediation, audit evidence, and compliance support for HIPAA, HITRUST, SOC 2, and FedRAMP.

Supports security operations by onboarding and troubleshooting network monitoring infrastructure, triaging security-device issues, resolving escalated customer problems, coordinating vendor maintenance, and managing hardware sensors. The role collaborates with SOC analysts, assists with testing and quality assurance, provides customer support, and participates in on-call incident response. Requires network and security administration experience, TCP/IP knowledge, command-line expertise, and troubleshooting across Linux, Windows, and macOS.

Own and improve vulnerability management across cloud, on-premises, network, and endpoint environments. Responsibilities include scanning, triage, risk-based prioritization, remediation coordination, SLA tracking, exception management, closure validation, asset reconciliation, reporting, incident support, on-call participation, and audit documentation. The role partners with Engineering, SRE, IT, and Infrastructure teams and uses security tooling and AI-assisted workflows to reduce exposure and recurring vulnerabilities.

Develops secure, isolated attack scenarios across cloud, on-premises, and hybrid environments. Reproduces vulnerabilities, builds multi-step attack chains, creates automated graders and reward signals, and validates outcomes using system state and telemetry. The role also develops attack variants and benign comparisons to evaluate AI security agents, partnering with threat researchers, AI engineers, and environment engineers.

Lead security reviews, code audits, penetration testing, vulnerability research, and mitigation efforts for Microsoft Windows services. Develop reusable security tools and agents, identify attack vectors and architectural risks, demonstrate exploit impact, and collaborate with product engineering teams to design scalable defenses and improve security investments.

Create challenging coding tasks for AI systems, implement deterministic solution verifiers, and contribute backend expertise across feature development, bug fixing, refactoring, performance optimization, testing, and security reviews. The role requires strong programming and software engineering skills, with cybersecurity experience in secure coding, application security, penetration testing, vulnerability assessment, or security-focused code reviews preferred.

Build and secure scalable backend services and APIs while debugging, optimizing performance, implementing features, refactoring codebases, and conducting security reviews and penetration testing. The role also involves automated testing, code review, vulnerability assessment, and contributing domain expertise to training next-generation AI systems.

Designs, deploys, and manages enterprise cloud security solutions across AWS and Azure. Responsibilities include automating security controls, managing AWS WAF and CDK rules, improving policies, patching vulnerabilities, implementing DevSecOps practices, assessing cloud applications and APIs, monitoring security posture, analyzing logs, triaging issues, and supporting compliance and risk initiatives.

Lead Stord’s enterprise security function and build its long-term strategy, governance, operations, engineering, application and cloud security capabilities. Own NIST, SOC 2 and ISO programs, 24/7 detection and response, incident management, M&A security integration, secure product development, penetration testing, customer trust, business continuity and disaster recovery. Lead the security team, MDR partnership, executive and board communications, AI governance, and security readiness for international growth, acquisitions and potential public-market scrutiny.

Architect and engineer multi-tenant SIEM, SOAR, EDR, telemetry, and cloud security platforms for managed security services. Build detection content, automate response workflows, optimize log ingestion, and secure customer connectivity. Lead technical discovery, onboarding, security assessments, remediation planning, escalations, solution design, and customer advisory engagements. Create architectures, runbooks, and documentation while shaping the MSSP technology strategy.

Supports enterprise application security by operating SAST, DAST, IAST, and IDE security tools; developing pipelines; securing web applications; troubleshooting Linux environments; and implementing enterprise security controls. The role applies OWASP and federal compliance standards, collaborates with clients and application teams, and requires experience with Veracode, Burp Suite, programming languages, and security testing tools.

Engineer and operate SIEM and SOAR platforms supporting SOC and MDR services. Responsibilities include log-source onboarding, parsing, enrichment, detection engineering, playbook automation, alert and dashboard development, end-to-end pipeline troubleshooting, vendor escalations, customer onboarding, ingest-volume management, documentation, and platform incident response. The role serves as the technical escalation point and participates in an after-hours on-call rotation.

Own and evolve GitLab’s authorization systems across its Ruby on Rails monolith and next-generation Rust policy engine. Design fine-grained permissions for users, tokens, roles, and AI agents; secure GraphQL and REST APIs; lead feature-flagged rollouts and migrations; improve performance and reliability; and collaborate across authentication, platform, AI, and modular-service teams in a distributed asynchronous environment.

Supports the IT Governance, Risk, and Compliance program through security risk assessments, policy administration, audit readiness, control validation, evidence collection, remediation tracking, regulatory compliance monitoring, and third-party risk reviews. The role maps controls to frameworks including HIPAA, SOC 2, NIST, CIS, CMS, and URAC; maintains risk registers and governance documentation; and partners with technical and business teams to address vulnerabilities, control gaps, and compliance requirements.