Blue Team Lead
Full-Time
No salary listed
Senior
Bachelor's
Washington, DC, USA
HybridHybrid role with on-site work in Washington, DC.
CybersecuritySecurity Operations & Incident Response
No H1B Sponsorship
US Top Secret Clearance Required
About the job
Requirements
- An active Public Trust clearance is required.
- A Bachelor of Science degree in Computer Science, Information Technology, or a related field is required.
- Five years of total project management-related experience in the cybersecurity or information technology industry is required, including development of policies and procedures, technical standards, and workflows.
- Three years of experience delivering cybersecurity services as part of a service delivery team and planning, managing, and performing cybersecurity assessments, including assessment reporting deliverables, is required.
- An active Certified Information Systems Auditor or Certified Information Systems Security Professional certification is required.
Responsibilities
- Lead and manage Blue Team support services that complement Red Team exercises and support overall Judiciary cybersecurity readiness.
- Develop methodologies for assessing customer environments using previous Red Team reporting, cybersecurity best practices, MITRE ATT&CK, NIST Cybersecurity Framework 2.0, and ITSO leadership guidance.
- Conduct pre-engagement technical assessments to identify security gaps, misconfigurations, control weaknesses, and opportunities for defensive improvements.
- Develop actionable mitigation recommendations identifying technical deficiencies, operational risks, remediation actions, required tools and skills, expected outcomes, and implementation timelines.
- Develop and deliver pre-engagement technical assessment reports and mitigation plans for AO staff and court units before Red Team exercises.
- Facilitate post-engagement meetings with Red Team customers and provide detailed remediation guidance based on Red Team findings.
- Perform post-engagement assessments using Red Team reports to identify missed controls, detection gaps, and unsuccessful defensive measures.
- Develop post-engagement assessment reports documenting improvements, residual risks, and recommended enhancements to customer environments.
- Lead the development and execution of cyber exercise support services, including governance, communication strategies, facilitation, and operational coordination.
- Design, plan, facilitate, and execute tabletop exercises, inject-driven cyber exercises, and operational readiness scenarios for technical and executive audiences.
- Develop realistic exercise scenarios aligned with current cyber threats, adversary tactics, techniques, procedures, and Judiciary operational environments.
- Coordinate with ITSO divisions, Security Operations Center personnel, Detection Engineering, Threat Hunting, Incident Response, and Cyber Threat Intelligence teams to support exercise planning and defensive operations.
- Conduct post-exercise analysis and develop executive summaries detailing strengths, weaknesses, lessons learned, operational readiness, and improvement opportunities.
- Support Detection Engineering efforts by assisting with analysis of threats, exploits, attack techniques, detection opportunities, and defensive recommendations.
- Develop and brief technical and executive-level presentations regarding Blue Team activities, cyber exercises, threat trends, and defensive posture improvements.
- Develop key performance indicator metrics, operational reporting, annual summaries, and executive dashboards demonstrating improvements in Judiciary cybersecurity protection measures.
- Provide operational leadership and oversight for Blue Team activities in alignment with Information Technology Infrastructure Library version 4 service management principles and AO cybersecurity directives.
- Participate in weekly technical meetings, monthly program reviews, operational readiness meetings, and stakeholder briefings.
- Develop and maintain standard operating procedures, work instructions, governance documentation, communication strategies, and process documentation supporting Blue Team operations.
- Assist with transition-in and transition-out planning, operational readiness activities, and knowledge transfer requirements.
- Collaborate with Red Team personnel to evaluate exploit paths, detection opportunities, and mitigation effectiveness.
- Support continuous improvement initiatives by identifying gaps in people, process, and technology across cybersecurity operations.
- Maintain awareness of emerging threats, adversary tradecraft, cybersecurity frameworks, and defensive security technologies relevant to the Federal Judiciary.
About the company
cFocus Software provides cybersecurity, cross-domain, geospatial, and IT services to federal government agencies. It helps agencies design, implement, and manage security architectures, cross-domain data workflows, and geospatial solutions through consulting, implementation, and ongoing support. It differentiates itself with 18+ years of federal-focused experience and deep domain knowledge in government cybersecurity and geospatial work. Its goal is to help federal agencies protect operations, comply with regulations, and optimize IT and geospatial capabilities for secure, efficient government services.
Company Size
11-50
Company Stage
N/A
Total Funding
N/A
Headquarters
Largo, Florida
Founded
2006
Get referred to cFocus Software
See people who can refer or advise you
Simplify's Take
What believers are saying
- DHS won its geospatial protest on July 29, 2026, validating cFocus's award.
- GAO denied the NIH emergency call center protest, confirming competitive strength.
- CMMC Level 2 and renewed ISO certifications on July 11 and July 16, 2025 strengthen bids.
What critics are saying
- HUD OCIO POG 4 task order expires September 29, 2026, risking $3.7 million.
- DFC cyber BPA ends September 23, 2026, shrinking recurring revenue visibility.
- Dependence on federal recompetes invites displacement by larger integrators and cloud specialists.
What makes cFocus Software unique
- Microsoft Gold Certified Partner with FedRAMP automation and Azure Government focus.
- Exclusive ATO as a Service branding distinguishes cFocus in federal cloud compliance.
- Small-business SDB status helps win set-aside federal IT work.
Help us improve and share your feedback! Did you find this helpful?
Benefits
Remote Work Options