Dragonfli Group

DevOps Engineer

• Build, maintain, and enhance CI/CD pipeline templates to support services deployed into AWS and client-managed environments
• Triage and resolve failed pipelines and deployments, conducting thorough root cause analysis and implementing corrective actions
• Support codebases requiring new pipeline template development and modernization
• Perform patching, administration, and lifecycle management of core DevOps tooling, including: SonarQube, Sonatype, Nexus, Harness, GitHub, Azure DevOps, and Jira
• Lead and support GitHub repository onboarding and associated automation workflows
• Operate, maintain, and tune security scanning tools, including rule configuration and optimization for SonarQube, Sonatype, and Nexus
• Identify opportunities to improve pipeline efficiency, reduce technical debt, and strengthen secure delivery practices

DevSecOps Pipeline, Tooling Engineer

Security Engineer

• Execute and maintain all RMF lifecycle activities for assigned federal information systems: categorization, control selection, implementation, assessment, authorization, and continuous monitoring
• Develop, maintain, and update system security documentation including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), and Authorization to Operate (ATO) packages
• Coordinate with Information System Owners (ISOs), Authorizing Officials (AOs), and Security Control Assessors (SCAs) to drive ATO decisions on schedule
• Monitor security controls on an ongoing basis; identify, document, and track deviations and vulnerabilities to closure
• Conduct and support continuous monitoring activities including log review, vulnerability scan analysis, and configuration compliance validation
• Support incident response activities including documentation, escalation, and remediation tracking
• Maintain system inventory, hardware/software baselines, and interconnection agreements
• Ensure compliance with applicable federal directives including FISMA, OMB A-130, and agency-specific security policies
• Participate in security reviews, audits, and inspections as required

Information System Security Officer

Analyst

• Execute hands-on remediation tasks across NERC CIP standards CIP-003 through CIP-013 as directed by the audit readiness lead
• Implement technical and procedural controls to close compliance gaps identified through gap assessments and mock audit findings
• Compile, organize, and QA/QC compliance evidence packages in support of WECC audit submission
• Document remediation activities, control test results, and closure evidence with precision
• Coordinate with internal IT, OT, and compliance staff to validate remediation completion across technical and regulatory domains
• Support cyber asset identification, BES Cyber System categorization, and control implementation activities
• Maintain detailed work logs in support of T&M billing and audit trail requirements
• Escalate blockers and risks to engagement lead without delay

NERC CIP Remediation Analyst

Architect

• Lead all current state analysis: ingest volume baseline, use case library maturity audit, XDR/SIEM convergence analysis, data lake evaluation, DLP posture assessment, and retention gap analysis
• Populate and validate a proprietary multi-vendor SIEM scoring dashboard using actual client contract and usage data
• Build a 3-year total cost of ownership model across five vendor platforms
• Produce the following deliverables under the direction of the Engagement Lead: Current State Findings Summary, Vendor Recommendation Report, Target State Architecture Overview, SIEM Assessment Dashboard, Phase 2 Roadmap Framework
• Participate in and provide technical defense during two client-facing working sessions (90 min each, video call)
• Mentor a junior Cybersecurity Engineer Analyst on the team throughout the engagement
• Work directly alongside the Dragonfli Engagement Lead (CEO) on all client interactions

Senior SIEM Architect/SME

Engineer

• Lead the design, implementation, and deployment of CyberArk PAM solutions aligned with client requirements and industry best practices
• Develop and maintain PAM strategy and roadmap, including vendor assessments and capability evaluations of PAM technologies
• Conduct PAM architecture assessments and system audits to ensure alignment with industry guidelines, compliance requirements, and management-approved standards
• Establish and manage a continual service improvement plan focused on operational, process, and resource efficiency
• Identify and evaluate complex business and technology risks, internal controls that mitigate those risks, and opportunities for improvement
• Create and enforce strategies for secrets management, privileged account management, and session monitoring
• Partner with core PAM stakeholders to implement evolving processes and solutions
• Collaborate with business and technical partners to identify and scope PAM opportunities, quantify costs, and outline ROI, risks, and constraints
• Interpret and apply corporate security standards and baselines; develop and maintain cybersecurity policies
• Provide training and technical guidance to security operations teams, application owners, and IT staff
• Manage and mitigate risks associated with privileged accounts by enforcing least privilege principles
• Communicate technical and functional aspects of PAM solutions effectively to diverse, globally distributed teams
• Identify opportunities to improve engagement profitability

CyberArk PAM Engineer

Consultant

• Install, integrate, and deploy CyberArk Privileged Access Management (PAM) solutions across client environments
• Lead PAM engagements and provide technical guidance and mentorship to team members
• Serve as the Subject Matter Expert (SME) and train professionals on PAM technologies and best practices
• Communicate product capabilities and implementation details to clients and partners at both technical and functional levels
• Conduct post-sales requirements gathering, analysis, and documentation
• Contribute to proposal development, RFP responses, pricing strategies, engagement letters, and Statements of Work
• Perform PAM operational tasks including creating and managing safes, platforms, owners, access control policies, user provisioning, entitlements, and application credential management
• Identify automation opportunities and develop scripts using PACLI and REST APIs to streamline engineering tasks
• Integrate CyberArk with diverse platforms including LDAP providers, Windows Servers, UNIX/Linux Servers, databases, and network devices
• Administer privileged user accounts across Windows and UNIX environments using CyberArk components
• Develop and customize connectors and plugins for target applications
• Test and certify new product versions and bug fixes, and provide detailed reports
• Automate local administrator accounts across Windows desktops, servers, RHEL, Solaris v10/v11, IBM AIX, and HP environments
• Provide continuous operations and maintenance support including patches, releases, upgrades, and security vulnerability remediation
• Design technical architectures, use cases, and conceptual/logical flows for PAM solutions
• Develop and document standard operating procedures (SOPs), system architectures, and configuration guidelines
• Interpret and analyze corporate security standards and baselines; contribute to cybersecurity policy development

Senior CyberArk PAM Consultant

QA Engineer

• Engagement Scoping & Planning: Partner with stakeholders to define objectives, rules of engagement, and success criteria to ensure safe execution.
• Reconnaissance & Enumeration: Perform passive and active discovery of attack surfaces, services, and APIs to map trust boundaries.
• Manual Application Testing: Conduct deep testing of web and mobile apps aligned with OWASP Top 10 and common design flaws.
• Vulnerability Validation: Safely verify findings such as XSS, SQLi, CSRF, SSRF, and broken access control to demonstrate real-world impact.
• Network & Infrastructure Testing: Identify weaknesses in exposed services, insecure protocols, and misconfigurations across hybrid environments.
• Post-Exploitation Analysis: Assess blast radius, lateral movement paths, and persistence risks while minimizing operational impact.
• Reporting & Remediation: Deliver clear technical reports with reproduction steps and prioritized fixes for both engineers and leadership.

Penetration Tester

• Lead technical onboarding of enterprise applications into Okta, including SSO configuration
• Implement and validate MFA configurations for onboarded applications
• Configure and manage provisioning integrations as part of application onboarding
• Collaborate with application owners to gather integration requirements
• Partner with business stakeholders to define and document access policies
• Develop and maintain onboarding runbooks and reusable templates
• Support campaign-driven intake processes through an Identity Service Center
• Design, build, and test Okta Workflows to automate identity lifecycle events
• Create approval workflows, access certification campaigns, and role-based access provisioning
• Integrate Okta Workflows with downstream systems (e.g., ServiceNow)
• Troubleshoot and optimize existing workflows to reduce manual effort and improve cycle times

Okta Identity Engineer

Project Manager

• Manage multiple projects from initiation through successful completion, including scope, objectives, schedules, and metrics
• Develop and maintain project plans, schedules, and status reporting for ongoing and complex efforts
• Draft, update, and publish standard operating procedures (SOPs) and runbooks
• Lead and coordinate special projects supporting security and compliance objectives
• Plan and coordinate application/system retirements and remnant clean-up activities across the organization
• Verify remnant removal and coordinate stakeholder actions to minimize security risks during retirements
• Support revisions of outdated compliance reviews for large volumes of information resources
• Maintain ongoing updates to vital security and governance documentation
• Provide inputs to cybersecurity policies, processes, SOPs, and training documents
• Prepare presentations and brief executives, managers, and peers on project progress and outcomes
• Create, customize, and manage SharePoint Team sites and related content (documents, lists, libraries)

A&A Project Manager

Auditor

• Lead on-site and off-site internal audits of registered entities to ensure strict adherence to NERC and regional O&P standards.
• Review and assess potential violations, providing expert oversight on the development and filing of mitigation plans.
• Perform deep-dive gap analyses and documentation reviews to identify and rectify compliance deficiencies.
• Conduct Inherent Risk Assessments (IRA) and Internal Controls Evaluations (ICE) to facilitate high-level reliability assurance.
• Provide technical guidance and instruction to registered entities and staff through workshops and compliance user group meetings.
• Author and review program-level and plan-level documents, specifically regarding CIP, PRC-005, and O&P requirements.

NERC O&P Auditor

• Conduct rigorous Operations and Planning (O&P) assessments.
• Execute comprehensive internal audits and gap analyses that mirror the strict technical rigor of Regional Entity enforcement.
• Ensure that all reliability standards and internal controls are robust, fully documented, and operationally sound.
• Lead on-site and off-site internal audits of registered entities to ensure strict adherence to NERC and regional O&P standards.
• Review and assess potential violations, providing expert oversight on the development and filing of mitigation plans.
• Perform deep-dive gap analyses and documentation reviews to identify and rectify compliance deficiencies.
• Conduct Inherent Risk Assessments (IRA) and Internal Controls Evaluations (ICE) to facilitate high-level reliability assurance.
• Provide technical guidance and instruction to registered entities and staff through workshops and compliance user group meetings.
• Author and review program-level and plan-level documents, specifically regarding CIP, PRC-005, and O&P requirements.

NERC Compliance Auditor

Cybersecurity Program Manager

System Administrator

• Own the full lifecycle of Linux-focused patch coordination for real-time devices across development, test, and production environments.
• Plan and execute monthly Linux patch discovery and evaluation cycles, covering kernels, packages, agents, and repository hygiene.
• Coordinate quarterly Linux patch deployments, including scheduling maintenance windows, planning rollbacks, and executing validation steps.
• Drive artifact creation for compliance audits, including patch evidence, change records, test results, deployment logs, and exception documentation.
• Build comprehensive Linux patch test plans and production deployment plans that align with strict client change discipline.
• Partner with platform owners to troubleshoot patch failures, investigate root causes, and reduce recurring deployment defects.
• Create and execute patch runbooks, test plans, and verification checklists to ensure system integrity.

Linux Administrator

• Assist in developing playbooks, workflows, and implementation roadmaps to mature the Insider Threat operational support program.
• Administer and optimize the Insider Risk toolset, specifically DLP, UEBA, SIEM, and Microsoft Defender/Entra/Purview.
• Develop and maintain a convergence model to reduce risk to personnel and assets across regional operating divisions.
• Lead and assist in the investigation of all incidents involving potential insider threats.
• Coordinate with business and technology leaders to develop programmatic solutions and deliver high-level presentations on findings.
• Implement federal government and industry standards regarding insider threat programs and maintain programmatic gap analyses.