Senior Cyber Operations Analyst

Everforth ECS is seeking a Senior Cyber Operations Analyst to work in a hybrid capacity at our Fairfax, VA office.

The Senior Cyber Operations Analyst will support a newly established DISA AWS environment handling CUI. This position will serve as the primary subject matter expert for vulnerability management and endpoint security operations, with responsibility for operating ACAS and managing Trellix, including ePO, endpoint security policies, agent health, alerts, and reporting.

The ideal candidate is a technically strong cybersecurity professional who can independently analyze vulnerability and endpoint security data, configure and modify scans and security policies, troubleshoot operational issues, develop reports and metrics, and coordinate remediation with technical teams. The Senior Cyber Operations Analyst reports to the Senior Information System Security Manager. 

Job Responsibilities:

• Serve as the primary operational SME for ACAS vulnerability management and endpoint security capabilities.
• Operate and configure:
  • ACAS, including scan policies, targets, credentials, schedules, plugin settings, and vulnerability reporting.
  • Approved endpoint security technologies such as Trellix, Microsoft Defender, or similar platforms, including policies, settings, agent health, exclusions, alerts, and security coverage.
• Create, modify, and execute routine, targeted, and ad hoc vulnerability scans based on operational requirements, DTOs, CVEs, and other cybersecurity directives.
• Troubleshoot credentialed scanning, authentication failures, incomplete scan coverage, plugin issues, and other conditions affecting scan results.
• Analyze vulnerability results to identify affected assets, validate findings, identify trends, support remediation efforts, and verify closure through rescanning.
• Review and investigate endpoint security alerts, malware detections, policy violations, and other suspicious activity and coordinate escalation to the SOC when additional investigation or incident response is required.
• Tune endpoint security policies, configurations, and exclusions to reduce false positives while maintaining required security protections.
• Evaluate DTOs, CVEs, vulnerability notifications, and emerging security issues to determine potential impact to the environment and coordinate validation activities as needed.
• Develop vulnerability and endpoint security dashboards, metrics, reports, spreadsheets, and trend analysis to support cybersecurity leadership, continuous monitoring, POA&M management, and authorization activities.
• Develop and maintain procedures, runbooks, configuration documentation, and operational processes for vulnerability management and endpoint security activities.
• Work with technical teams to coordinate vulnerability remediation, validate corrective actions, track outstanding findings, and improve overall security posture.
• Monitor the health and effectiveness of vulnerability scanning and endpoint security coverage and identify gaps requiring corrective action.
• Support integration of vulnerability and endpoint security data with the program's SIEM and other monitoring capabilities.
• Provide technical evidence, scan results, metrics, and remediation documentation in support of RMF, continuous monitoring, security assessments, and authorization activities.
• Continuously evaluate and improve vulnerability management, endpoint security, reporting, and remediation processes.
• Other duties, as assigned.

Salary: $170,000-190,000

General Description of Benefits 

• U.S. Citizen.
• Ability to obtain Secret clearance (active preferred)
• Active DoD 8140 IAT Level II Security+ (or higher).
• Ability to work up to 3 days a week in a hybrid capacity out of Fairfax, VA. Additional onsite support may be required based on operational or mission needs.
• 8+ years of cybersecurity experience with a strong background in vulnerability management and endpoint security.
• Experience administering:
  • ACAS, including creating and modifying scans, managing targets and credentials, scheduling scans, reviewing plugin results, troubleshooting authentication issues, and producing vulnerability reports.
  • Trellix and ePolicy Orchestrator (ePO), including endpoint policies, agent health, alerts, exclusions, updates, deployments, and reporting.
• Ability to independently manage ACAS and Trellix operations.
• Experience with the following:
  • Reviewing ACAS results, validating findings, identifying affected systems, coordinating remediation, and confirming closure through rescans.
  • Reviewing endpoint security alerts and events, determining when additional investigation or escalation is required, and working with technical teams to address findings.
  • Developing vulnerability and endpoint security reports, metrics, dashboards, and spreadsheets for cybersecurity leadership, continuous monitoring, and POA&M tracking.
  • Developing and maintaining SOPs for vulnerability management, endpoint security, and related cyber operations in a new environment.
• Ability to evaluate CVEs, DTOs, vulnerability notifications, and other security advisories to determine whether systems are affected and perform targeted validation when needed.
• Working knowledge of Windows, Linux, networking, AWS, and Active Directory as they relate to vulnerability scanning and endpoint security.
• Familiarity with DoD vulnerability management, DISA STIGs, RMF, continuous monitoring, and POA&M processes.
• Strong troubleshooting, documentation, and communication skills with the ability to work directly with engineers and system administrators to resolve security findings.
• Strong problem-solving and decision-making capabilities, with a proven ability to weigh the relative costs and benefits of potential actions and identify the most appropriate solution.
• Highly developed interpersonal and oral/written communication skills, with the ability to effectively and professionally interact with a diverse set of stakeholders (from peers to end-users to executive management).