Senior Cyber Operations Analyst

Everforth ECS is seeking a Senior Cyber Operations Analyst to work in a hybrid capacity at our Fairfax, VA office.

The Senior Cyber Operations Analyst will support a newly established DISA AWS environment handling CUI. This position will serve as the primary subject matter expert for vulnerability management and endpoint security operations, with responsibility for operating ACAS and managing Trellix, including ePO, endpoint security policies, agent health, alerts, and reporting.

The ideal candidate is a technically strong cybersecurity professional who can independently analyze vulnerability and endpoint security data, configure and modify scans and security policies, troubleshoot operational issues, develop reports and metrics, and coordinate remediation with technical teams. The Senior Cyber Operations Analyst reports to the Senior Information System Security Manager.

Job Responsibilities:

• Serve as the primary operational SME for ACAS vulnerability management and endpoint security capabilities.
• Operate and configure:
  • ACAS, including scan policies, targets, credentials, schedules, plugin settings, and vulnerability reporting.
  • Approved endpoint security technologies such as Trellix, Microsoft Defender, or similar platforms, including policies, settings, agent health, exclusions, alerts, and security coverage.
• Create, modify, and execute routine, targeted, and ad hoc vulnerability scans based on operational requirements, DTOs, CVEs, and other cybersecurity directives.
• Troubleshoot credentialed scanning, authentication failures, incomplete scan coverage, plugin issues, and other conditions affecting scan results.
• Analyze vulnerability results to identify affected assets, validate findings, identify trends, support remediation efforts, and verify closure through rescanning.
• Review and investigate endpoint security alerts, malware detections, policy violations, and other suspicious activity and coordinate escalation to the SOC when additional investigation or incident response is required.
• Tune endpoint security policies, configurations, and exclusions to reduce false positives while maintaining required security protections.
• Evaluate DTOs, CVEs, vulnerability notifications, and emerging security issues to determine potential impact to the environment and coordinate validation activities as needed.
• Develop vulnerability and endpoint security dashboards, metrics, reports, spreadsheets, and trend analysis to support cybersecurity leadership, continuous monitoring, POA&M management, and authorization activities.
• Develop and maintain procedures, runbooks, configuration documentation, and operational processes for vulnerability management and endpoint security activities.
• Work with technical teams to coordinate vulnerability remediation, validate corrective actions, track outstanding findings, and improve overall security posture.
• Monitor the health and effectiveness of vulnerability scanning and endpoint security coverage and identify gaps requiring corrective action.
• Support integration of vulnerability and endpoint security data with the program's SIEM and other monitoring capabilities.
• Provide technical evidence, scan results, metrics, and remediation documentation in support of RMF, continuous monitoring, security assessments, and authorization activities.
• Continuously evaluate and improve vulnerability management, endpoint security, reporting, and remediation processes.
• Other duties, as assigned.

Salary: $170,000-190,000

General Description of Benefits