Dragonfli Group

Business Analyst

• Lead and manage end-to-end vulnerability disclosure programs (VDP), including coordination with ethical hackers, system owners, and agency stakeholders.
• Own attack surface management programs (e.g., CISA FAST), including scheduling, scope management, findings coordination, and POA&M documentation.
• Manage and update Standard Operating Procedures (SOPs), SharePoint repositories, and program tracking documentation.
• Operate and maintain enterprise vulnerability scanning platforms including Tenable.sc, Tenable.io, and web application scanning tools.
• Scope, schedule, execute, and report on vulnerability scans across large, complex federal environments.
• Track and drive remediation of critical, high, and all severity-tiered vulnerabilities to closure within program SLAs.
• Build and maintain working relationships with CISA contacts, agency system owners, SOC personnel, and contractor teams.

Vulnerability Management Analyst

Security Engineer

• Own end-to-end strategy, implementation, and operational health of CrowdStrike Falcon Identity Protection and the CSPM capabilities within CrowdStrike Cloud Security
• Proactively identify identity-based threats, misconfigurations, and cloud security gaps; drive remediation to closure in accordance with client policies and procedures
• Configure, tune, and maintain identity protection policies, IOM and IOA policies, and risk-based authentication controls
• Serve as the escalation point and trusted technical advisor to client leadership on identity and cloud security matters
• Develop runbooks, detection logic, and automation to reduce manual effort and improve response times
• Monitor the threat landscape and translate emerging risks into actionable hardening recommendations
• Coordinate and lead governance calls with stakeholders; produce agenda, notes, and follow-up actions independently
• Partner with other cybersecurity teams to integrate CrowdStrike telemetry into broader security operations
• Produce metrics, dashboards, and executive-level reporting on identity and cloud security posture
• Apply deep knowledge of identity-based attack techniques — including lateral movement, credential theft, Kerberoasting, and pass-the-hash — to inform detection and response strategy

Identity Security Engineer – ITDR, CSPM

Consultant

• Review and update existing NERC CIP policies and procedures to reflect virtualization requirements under NERC Project 2016-02
• Develop new documentation for in-scope BES Cyber Systems across all project phases including design, build, and delivery
• Document technical and procedural requirements for virtualized environments supporting critical infrastructure
• Develop testing and evidence collection strategies to support CIP compliance audits
• Update Management Model documentation to reflect changes in processes and procedures
• Conduct awareness and education sessions to drive organizational understanding of CIP virtualization changes
• Leverage assessment tools such as Tripwire or AssurX to support gap analysis and ongoing compliance monitoring
• Collaborate with internal stakeholders across IT, OT, and compliance functions to socialize policy changes
• Serve as a subject matter expert on NERC CIP standards, providing technical and regulatory guidance to project teams
• Support engagement planning, analysis, and stakeholder coordination throughout all project phases

NERC CIP Virtualization Consultant

Security Analyst

• Drive identity security initiatives by generating metrics-that-matter within existing enterprise identity platforms
• Extract, transform, and analyze identity and security data using the Databricks platform
• Develop and deliver reports and dashboards from Databricks to support program visibility and decision-making
• Apply AI/ML techniques to detect fraudulent activity and support authentication of user identities at enterprise scale
• Contribute to data quality improvement efforts across identity and security data sets
• Support technical implementations related to identity tools including Okta and Ping
• Prepare and deliver executive briefings that communicate complex identity security data in a clear and compelling narrative format
• Manage stakeholder relationships across multiple functional groups, translating technical findings into business-relevant insights
• Collaborate with cross-functional teams to align identity metrics with broader security program goals
• Document processes, findings, and reporting outputs to maintain program continuity and institutional knowledge
• Support continuous improvement of identity security reporting frameworks and measurement methodologies

Junior Identity Security Analyst

• Design and implement automated compliance assessments to enforce hardening standards such as CIS and NIST across cloud accounts and on-premises virtualized environments
• Architect and maintain data-at-rest and data-in-transit encryption strategies spanning physical data center servers and cloud-native storage
• Develop and secure an enterprise Identity Fabric supporting 600,000+ employees and millions of commercial customers, integrating fraud detection signals from SIEM and big data analytics platforms
• Build and manage secure hybrid connectivity solutions including Transit Gateways and Service Mesh between on-premises hypervisors and multi-cloud environments, enforcing consistent policy across all tenants
• Partner with the SOC to develop high-fidelity detection logic and build SOAR playbooks that automate the isolation of compromised cloud workloads and on-premises virtual machines
• Support ongoing Purple Team exercises and control testing to validate the performance of security tools including EDR, WAF, and DLP across all environments
• Establish security guardrails for enterprise and customer-facing AI models, including protections for Databricks training pipelines against data poisoning and mitigations for LLM-specific threats such as prompt injection and sensitive data leakage
• Drive the transition from manual security operations to autonomous, ML-triggered auto-remediation across hybrid environments using advanced SOAR playbook development
• Discover and catalog Shadow AI usage across the enterprise, ensuring all third-party AI tools meet privacy and security standards
• Partner with business units to integrate security controls invisibly into logistics and retail workflows, enabling continuous and programmatic compliance with PCI, SOC 2, and related frameworks
• Build API-driven automation to connect disparate security and business applications, reducing manual friction and enabling self-healing security operations
• Communicate AI-driven security decisions and false positive handling clearly to non-technical stakeholders and program leadership

Senior Cloud Security Engineer

Senior Cloud Security Engineer – Hybrid, Multi-Cloud

• Lead the design of a global Zero Trust architecture, ensuring robust identity governance (IAM), network micro-segmentation, and data encryption across AWS, Azure, and/or GCP
• Architect specialized security frameworks for AI/ML pipelines, focusing on data privacy for training sets, model integrity, and securing LLM-integrated applications against emerging attack vectors
• Develop and enforce enterprise-wide security policies using Infrastructure-as-Code tools (e.g., Terraform), ensuring non-compliant infrastructure is automatically remediated or blocked from deployment
• Design and oversee integration of CNAPP and CSPM tools to provide real-time visibility into misconfigurations, vulnerabilities, and excessive permissions
• Conduct deep-dive threat modeling for complex cloud-native systems, simulating advanced persistent threats (APTs) and blast-radius scenarios to strengthen system resilience
• Drive the organization's transition to a Zero Standing Privilege model for all production environments
• Achieve automated auditing for core compliance frameworks, including NIST and CIS Benchmarks
• Leverage AI-driven monitoring to minimize Mean Time to Detect (MTTD) anomalous cloud activity
• Act as lead security advisor for the Cloud Architecture team, bridging DevOps agility with rigorous regulatory compliance (SOC 2, FedRAMP)
• Communicate security risks, architecture decisions, and roadmap recommendations clearly to C-suite and executive stakeholders
• Embed automated security testing (SAST/DAST/SCA) directly into CI/CD pipelines as part of a mature DevSecOps practice

Senior Cloud Security Architect

• Manage security assessments for a variety of applications and domains, including cloud computing environments
• Lead multiple large, complex, high-risk security assessment initiatives concurrently
• Implement security controls and verify control effectiveness in alignment with NIST RMF and ISO standards
• Conduct risk assessments and document compliance measures to meet organizational and regulatory requirements
• Evaluate, validate, and support documentation required for A&A and accreditation activities for new and existing IT systems
• Ensure appropriate treatment of risk, compliance, and assurance from internal and external perspectives
• Support development of actionable security blueprints, principles, models, designs, standards, and guidelines
• Apply security architecture principles and best practices to help design and maintain secure IT infrastructures aligned to A&A policies
• Use network and vulnerability scanning tools to interrogate systems for configuration and security status
• Utilize GRC tools to manage and track A&A workflows, artifacts, and approvals
• Serve as an A&A subject matter expert, providing guidance to stakeholders, business units, and new A&A resources
• Build and maintain schedules and step-by-step action plans; brief cross-functional teams and executives on status and risk

Information System Security Officer – Assessment & Authorization

DevOps Engineer

• Lead the evolution of the software delivery lifecycle by embedding security into every stage of CI/CD
• Architect and maintain automated CI/CD pipelines using AI/ML for SAST/DAST to detect complex vulnerabilities
• Design security frameworks for the end-to-end AI lifecycle, including data ingestion security and model protection
• Implement guardrail architectures for Large Language Models (LLMs) and AI-native applications
• Develop AI-driven orchestration (SOAR) to automate triage and remediation of security findings
• Implement Policy as Code governance using Open Policy Agent (OPA) to enforce compliance across multi-cloud environments
• Integrate SAST, DAST, SCA, and secret scanning into GitHub Actions, GitLab CI, or Jenkins pipelines
• Conduct advanced threat modeling for cloud-native applications, including AI-specific attack vectors (e.g., model inversion, data poisoning)
• Create self-service security tools and Golden Paths to enable secure developer workflows with minimal friction
• Establish and enhance observability for security and reliability using eBPF, Prometheus, and logging/monitoring platforms (e.g., Dynatrace or Datadog)

Senior DevSecOps Architect

Risk

• Design, build, and maintain insider risk detection use cases and monitoring workflows with a primary focus on Splunk Enterprise Security, UEBA, and SPL content engineering
• Write, optimize, and operationalize Splunk searches, correlation rules, dashboards, and alerts to improve fidelity and reduce false positives
• Develop and refine detection use cases targeting anomalous user behavior, data exfiltration, policy violations, and suspicious endpoint activity
• Investigate alert and case trends to identify opportunities for rule tuning, use case expansion, and operational maturity improvement
• Support incident triage, investigation, and response related to insider risk, suspicious user behavior, and potential data misuse
• Perform CrowdStrike Falcon alert review, tuning, and incident response support including false positive identification and credible threat escalation
• Lead and assist in investigations involving potential insider threats, intellectual property matters, fraud, and high-stakes security incidents
• Develop and maintain playbooks and response workflows for insider risk scenarios
• Administer and optimize the insider risk toolset: Splunk ES, UEBA, CrowdStrike, Microsoft Purview/Defender/Entra, DLP, and adjacent technologies
• Analyze current tool utilization and recommend enhancements to improve detection visibility, investigation efficiency, and operational coverage
• Support continuous improvement across Splunk, CrowdStrike, Microsoft, DLP, Databricks, and SOAR platforms
• Implement federal government and industry standards related to insider threat programs and maintain programmatic gap analyses
• Partner with security operations, insider risk, cyber defense, and business stakeholders to improve detection coverage and response posture
• Coordinate with technology and business leaders to develop programmatic solutions and deliver executive-level presentations on findings and program status