cFocus Software

Federal cybersecurity, cross-domain, geospatial IT services

Blue Team Lead

Security Operations & Incident ResponseConfirmed live in the last 24 hours

Full-timeWashington, DC, USANo salary listed

About the Job

Requirements

Active Public Trust clearance.
Bachelor of Science degree in Computer Science, Information Technology, or a related field.
Five years of total project management-related experience in the cybersecurity or information technology industry, including development of policies and procedures, technical standards, and workflows.
Three years of experience delivering cybersecurity services as part of a service delivery team and planning, managing, and performing cybersecurity assessments, including assessment reporting deliverables.
Active CISA or CISSP certification.

Responsibilities

Lead and manage Blue Team support services that complement Red Team exercises and support overall Judiciary cybersecurity readiness.
Develop methodologies for assessing customer environments using previous Red Team reporting, cybersecurity best practices, MITRE ATT&CK, NIST CSF 2.0, and ITSO leadership guidance.
Conduct pre-engagement technical assessments to identify security gaps, misconfigurations, control weaknesses, and opportunities for defensive improvements.
Develop actionable mitigation recommendations identifying technical deficiencies, operational risks, remediation actions, required tools and skills, expected outcomes, and implementation timelines.
Develop and deliver pre-engagement technical assessment reports and mitigation plans for AO staff and court units before Red Team exercises.
Facilitate post-engagement meetings with Red Team customers and provide detailed remediation guidance based on Red Team activity findings.
Perform post-engagement assessments using Red Team reports to identify missed controls, detection gaps, and unsuccessful defensive measures.
Develop post-engagement assessment reports documenting improvements, residual risks, and recommended enhancements to customer environments.
Lead the development and execution of cyber exercise support services, including governance, communication strategies, facilitation, and operational coordination.
Design, plan, facilitate, and execute tabletop exercises, inject-driven cyber exercises, and operational readiness scenarios for technical and executive audiences.
Develop realistic exercise scenarios aligned with current cyber threats, adversary tactics, techniques, and procedures, and Judiciary operational environments.
Coordinate with ITSO Divisions, SOC personnel, Detection Engineering, Threat Hunting, Incident Response, and Cyber Threat Intelligence teams to support exercise planning and defensive operations.
Conduct post-exercise analysis and develop executive summaries detailing strengths, weaknesses, lessons learned, operational readiness, and improvement opportunities.
Support Detection Engineering by assisting with analysis of threats, exploits, attack techniques, detection opportunities, and defensive recommendations.
Develop and brief technical and executive-level presentations regarding Blue Team activities, cyber exercises, threat trends, and defensive posture improvements.
Develop KPI metrics, operational reporting, annual summaries, and executive dashboards demonstrating improvements in Judiciary cybersecurity protection measures.
Provide operational leadership and oversight for Blue Team activities in alignment with ITIL v4 service management principles and AO cybersecurity directives.
Participate in weekly technical meetings, monthly program reviews, operational readiness meetings, and stakeholder briefings.
Develop and maintain SOPs, work instructions, governance documentation, communication strategies, and process documentation supporting Blue Team operations.
Assist with transition-in and transition-out planning, operational readiness activities, and knowledge transfer requirements.
Collaborate with Red Team personnel to evaluate exploit paths, detection opportunities, and mitigation effectiveness.
Support continuous improvement initiatives by identifying gaps in people, process, and technology across cybersecurity operations.
Maintain awareness of emerging threats, adversary tradecraft, cybersecurity frameworks, and defensive security technologies relevant to the Federal Judiciary.

cFocus Software seeks a Blue Team Lead to join our program supporting the Administrative Office of the United States Courts (AOUSC). This position is Hybrid with the onsite location being in Washington, DC. This position requires a Public Trust clearance.
Qualifications:

Active Public Trust clearance
B.S. Computer Science, Information Technology, or a related field
Five (5) year’s total project management related experience in the Cybersecurity or information technology industry.
This includes development of policies and procedures, technical standards, and workflow development.
Three (3) years of experience delivering cybersecurity services as part of a service delivery team and planning, managing and performing cyber security assessments, including assessment reporting deliverables.
Active CISA or CISSP certification

Duties:

Lead and manage Blue Team support services that complement Red Team exercises and support overall Judiciary cybersecurity readiness.
Develop methodologies for assessing customer environments using previous Red Team reporting, cybersecurity best practices, MITRE ATT&CK, NIST CSF 2.0, and ITSO leadership guidance.
Conduct pre-engagement technical assessments to identify security gaps, misconfigurations, control weaknesses, and opportunities for defensive improvements.
Develop actionable mitigation recommendations that clearly identify technical deficiencies, operational risks, remediation actions, required tools and skills, expected outcomes, and implementation timelines.
Develop and deliver pre-engagement technical assessment reports and mitigation plans for AO staff and court units prior to Red Team exercises.
Facilitate post-engagement meetings with Red Team customers and provide detailed remediation guidance based on findings from Red Team activities.
Perform post-engagement assessments utilizing Red Team reports to identify missed controls, detection gaps, and unsuccessful defensive measures.
Develop post-engagement assessment reports documenting improvements, residual risks, and recommended enhancements to customer environments.
Lead the development and execution of cyber exercise support services including governance, communication strategies, facilitation, and operational coordination.
Design, plan, facilitate, and execute tabletop exercises, inject-driven cyber exercises, and operational readiness scenarios for technical and executive audiences.
Develop realistic exercise scenarios aligned to current cyber threats, adversary tactics, techniques, and procedures (TTPs), and Judiciary operational environments.
Coordinate with ITSO Divisions, SOC personnel, Detection Engineering, Threat Hunting, Incident Response, and Cyber Threat Intelligence teams to support exercise planning and defensive operations.
Conduct post-exercise analysis and develop executive summaries detailing strengths, weaknesses, lessons learned, operational readiness, and improvement opportunities.
Support Detection Engineering efforts by assisting with analysis of threats, exploits, attack techniques, detection opportunities, and defensive recommendations.
Develop and brief technical and executive-level presentations regarding Blue Team activities, cyber exercises, threat trends, and defensive posture improvements.
Develop KPI metrics, operational reporting, annual summaries, and executive dashboards demonstrating improvements in Judiciary cybersecurity protection measures.
Provide operational leadership and oversight for Blue Team activities in alignment with ITIL v4 service management principles and AO cybersecurity directives.
Participate in weekly technical meetings, monthly program reviews, operational readiness meetings, and stakeholder briefings.
Develop and maintain SOPs, work instructions, governance documentation, communication strategies, and process documentation supporting Blue Team operations.
Assist with transition-in and transition-out planning, operational readiness activities, and knowledge transfer requirements.
Collaborate with Red Team personnel to evaluate exploit paths, detection opportunities, and mitigation effectiveness.
Support continuous improvement initiatives by identifying gaps in people, process, and technology across cybersecurity operations.
Maintain awareness of emerging threats, adversary tradecraft, cybersecurity frameworks, and defensive security technologies relevant to the Federal Judiciary.

About the Company

cFocus Software

Federal cybersecurity, cross-domain, geospatial IT services

cFocus Software provides cybersecurity, cross-domain, geospatial, and IT services to federal government agencies. It designs and manages security architectures, conducts risk assessments, ensures compliance, and delivers IT and geospatial data solutions tailored to federal requirements. The company differentiates itself through 18+ years of government-focused experience across dozens of agencies and established, government-facing delivery processes. Its goal is to help federal agencies protect, operate, and optimize their IT and geospatial capabilities for secure and compliant government operations.

Company size: 11-50
Company stage: Not listed
Total funding: Not listed
Headquarters: Largo, FL
Founded: 2006

Recently Posted Jobs

Explore more opportunities at cFocus Software

See more jobs