Job description

Marathon TS is hiring a Senior Cybersecurity Tools Architect/Engineer in support of our Defense Counterintelligence Security Agency (DCSA) program based out of Quantico, VA.This is primarily a Telework position with a requirement to be onsite at least two (2) days a week or as needed at Quantico Marine Corps Base, VA. Position Description: We are seeking an exceptionally skilled and experienced Senior Cybersecurity Tools Architect/Engineer to lead our enterprise security architecture and tooling initiatives. The ideal candidate will serve as the technical authority for cybersecurity tools, platforms, and frameworks, responsible for defining, designing, and enhancing enterprise-wide security architectures that protect our organization's critical assets, data, and systems across complex, hybrid, and multi-cloud environments. This senior-level role requires deep expertise in selecting, integrating, and optimizing advanced cybersecurity tools including SIEM/SOAR platforms, firewalls, endpoint detection and response (EDR) solutions, and other security technologies. The Senior Cybersecurity Tools Architect/Engineer will design and implement comprehensive incident response and threat analysis architectures, ensure compliance with federal regulations and industry frameworks, and oversee the complete lifecycle of security systems from acquisition through modernization. The successful candidate will partner closely with Application, Data, Infrastructure, and Security Operations teams to architect scalable, resilient security solutions that align with business objectives while maintaining the highest standards of security posture and regulatory compliance. Minimum Requirements: • Experience: Minimum of 10 years of progressive experience in cybersecurity architecture and engineering, with at least 5 years of hands-on experience designing and implementing enterprise security tools and platforms in large-scale, complex environments • Security Clearance: Active Top-Secret Clearance REQUIRED, eligible to be upgraded to TS/SCI • Certification Requirements: • Must meet 8570 IASAE III certification requirements at the time of hire. (e.g., CISSP-ISSAP, CISSP- ISSEP certification). • Education: Bachelor's Degree in Cybersecurity, Computer Science, Information Systems Management, or a related field; Master's Degree preferred. An equivalent combination of military service and/or at least ten (10) years of significant, relevant work experience may be considered in lieu of degree requirement. Required Technical Expertise • Security Architecture and Design: • Deep expertise in enterprise security architecture frameworks (SABSA, TOGAF, Zachman) • Proven experience designing and implementing Cyber Security architectures and principles • Advanced knowledge of defense-in-depth strategies and layered security controls • Experience with on-prem and cloud solutions security architectures • Expertise in secure network architecture, segmentation, and micro-segmentation strategies • Security Tools and Platforms: • SIEM/SOAR Platforms: Extensive experience with enterprise SIEM solutions (Splunk, IBM QRadar, Microsoft Sentinel, LogRhythm, etc.) and SOAR platforms (Palo Alto Cortex XSOAR, Splunk Phantom, IBM Resilient) • Endpoint Security: Deep knowledge of EDR/XDR solutions (CrowdStrike, Microsoft Defender for Endpoint, SentinelOne, Carbon Black) • Network Security: Advanced experience with next-generation firewalls (Palo Alto, Fortinet, Cisco Firepower), IDS/IPS, web application firewalls (WAF), and network access control (NAC) • Vulnerability Management: Expertise with vulnerability scanning and management platforms (Tenable, Qualys, Rapid7) • Cloud Security: Experience with cloud-native security tools (AWS Security Hub, Azure Security Center, GCP Security Command Center) and CASB solutions • Identity and Access Management: Strong understanding of IAM platforms, PAM solutions, and identity governance • Compliance and Risk Management: • Comprehensive understanding of federal cybersecurity frameworks and regulations: • NIST Cybersecurity Framework (CSF) • NIST Risk Management Framework (RMF) and NIST 800-53 • FISMA, FedRAMP, CMMC, DFARS • ISO 27001/27002 • DoD Security Technical Implementation Guides (STIGs) • Experience with security assessment and authorization (SA&A) processes and Authority to Operate (ATO) procedures • Strong knowledge of risk assessment methodologies and tools • Technical Skills: • Proficiency in scripting and automation (Python, PowerShell, Bash) • Experience with Infrastructure as Code (IaC) and security automation (Terraform, Ansible, CloudFormation) • Strong understanding of DevSecOps principles and CI/CD security integration • Knowledge of containerization and orchestration security (Docker, Kubernetes) • Experience with API security and microservices architectures Core Job Responsibilities • Tool Integration and Platform Management • Lead the selection, evaluation, testing, and integration of enterprise security software, SIEM/SOAR platforms, firewalls, endpoint defenses, and other cybersecurity tools • Design and implement comprehensive integration strategies to ensure seamless interoperability between security tools and enterprise systems • Architect data flows and correlation rules across security platforms to enable effective threat detection and response • Develop and maintain security tool roadmaps aligned with organizational security strategy and emerging threats • Optimize security tool configurations for maximum effectiveness, performance, and cost efficiency • Establish and enforce security tool governance frameworks, including change management and configuration standards • Framework Design and Architecture • Build comprehensive security strategies that address hybrid environments and ensure consistent security posture across platforms • Develop reference architectures and design patterns for secure application deployment, data protection, and infrastructure hardening • Create security architecture blueprints for emerging technologies including cloud-native applications, IoT, and edge computing • Design resilient security architectures that support business continuity, disaster recovery, and high availability requirements • Establish security architecture principles, standards, and guidelines that align with industry best practices and organizational objectives • Risk Management and Compliance • Align security system blueprints and architectures with regulatory mandates and compliance frameworks including NIST RMF, FISMA, FedRAMP, CMMC, ISO 27001, and DoD STIGs • Develop and maintain a comprehensive Security Risk Management Plan to support program and mission objectives • Conduct thorough security assessments, architecture reviews, and audits to identify vulnerabilities, gaps, and compliance deficiencies • Lead risk assessment activities including threat modeling, vulnerability analysis, and impact assessments • Implement remediation plans and compensating controls to address identified security risks and compliance gaps • Prepare security authorization packages and support Authority to Operate (ATO) processes • Monitor and report on security posture, risk metrics, and compliance status to senior leadership • Lifecycle Management • Oversee security architecture across the complete system lifecycle: acquisition, design, development, deployment, operations, and modernization phases • Develop security requirements and evaluation criteria for technology acquisitions and vendor selections • Plan and execute security tool upgrades, migrations, and modernization initiatives with minimal operational impact • Establish decommissioning procedures that ensure secure data disposal and system retirement • Manage technical debt and develop strategies for legacy system security enhancement or replacement • Policy, Standards, and Governance • Establish, document, and oversee the implementation of comprehensive security policies, standards, procedures, and guidelines • Develop security architecture standards for cloud adoption, application development, data protection, and infrastructure deployment • Create and maintain security baselines and hardening guides for operating systems, databases, applications, and network devices • Define security metrics, key performance indicators (KPIs), and key risk indicators (KRIs) to measure security effectiveness • Establish security architecture governance processes including design reviews, exception management, and variance tracking • Ensure security policies align with federal regulations, industry frameworks, and organizational risk tolerance • Technical Leadership and Innovation • Serve as the subject matter expert and technical authority for cybersecurity architecture and security tools • Provide advanced troubleshooting and resolution for complex security tool integration and operational issues • Lead proof-of-concept (POC) initiatives to evaluate emerging security technologies and innovative solutions • Research and analyze emerging threats, attack vectors, and security trends to inform architecture decisions • Drive continuous improvement initiatives to enhance security posture, operational efficiency, and cost optimization • Mentor and provide technical guidance to junior security architects, engineers, and analysts • Present complex security architectures and recommendations to senior leadership, technical teams, and business stakeholders • Training and Enablement • Develop and deliver training programs on security architecture principles, security tools, and best practices • Provide mentorship and career development guidance to junior team members • Lead knowledge transfer sessions during tool implementations and architecture transitions • Stay current with the latest security technologies, threat landscape, compliance requirements, and industry best practices through continuous learning and professional development • Work Environment and Physical Demands • This is primarily a Telework position with a requirement to be onsite up to two (2) days a week at Quantico Marine Corps Base, VA • If alternate worksite is other than DCSA facilities or corporate office space, must have the reliable ability to communicate over voice (cell phone preferred) and stable, capable internet connection • Must be able to communicate complex technical architectures, security concepts, and risk assessments to diverse audiences, including senior leadership, both verbally and in written form • May require occasional travel to other DCSA locations, vendor sites, or for training purposes (estimated • Preferred Qualifications • Experience in Department of Defense (DoD) or Federal Government environments • Previous experience supporting DCSA, DoD, or Intelligence Community programs • Advanced knowledge of DoD cybersecurity requirements, RMF processes, and authorization procedures • Experience with Continuous Diagnostics and Mitigation (CDM) program and tools • Background in penetration testing, red team operations, or offensive security • Experience with security orchestration, automation, and response (SOAR) development • Familiarity with threat intelligence platforms and frameworks (MITRE Telecommunication&CK, STIX/TAXII) • Experience with data loss prevention (DLP) and insider threat detection solutions • Knowledge of software-defined networking (SDN) and network function virtualization (NFV) security • Previous experience in a leadership, principal architect, or chief architect role • Published research, white papers, or presentations on cybersecurity architecture topics • Active participation in cybersecurity professional organizations and communities #cjjobs Marathon TS is committed to the development of a creative, diverse and inclusive work environment. In order to provide equal employment and advancement opportunities to all individuals, employment decisions at Marathon TS will be based on merit, qualifications, and abilities. Marathon TS does not discriminate against any person because of race, color, creed, religion, sex, national origin, disability, age or any other characteristic protected by law (referred to as "protected status ").

Requirements

Must-haves

Security Clearance: Active Top-Secret Clearance REQUIRED, eligible to be upgraded to TS/SCI
Must meet 8570 IASAE III certification requirements at the time of hire. (e.g., CISSP-ISSAP, CISSP- ISSEP certification).
Required Technical Expertise
Deep expertise in enterprise security architecture frameworks (SABSA, TOGAF, Zachman)
Proven experience designing and implementing Cyber Security architectures and principles
Advanced knowledge of defense-in-depth strategies and layered security controls
Experience with on-prem and cloud solutions security architectures
Expertise in secure network architecture, segmentation, and micro-segmentation strategies
SIEM/SOAR Platforms: Extensive experience with enterprise SIEM solutions (Splunk, IBM QRadar, Microsoft Sentinel, LogRhythm, etc.) and SOAR platforms (Palo Alto Cortex XSOAR, Splunk Phantom, IBM Resilient)
Endpoint Security: Deep knowledge of EDR/XDR solutions (CrowdStrike, Microsoft Defender for Endpoint, SentinelOne, Carbon Black)
Network Security: Advanced experience with next-generation firewalls (Palo Alto, Fortinet, Cisco Firepower), IDS/IPS, web application firewalls (WAF), and network access control (NAC)
Vulnerability Management: Expertise with vulnerability scanning and management platforms (Tenable, Qualys, Rapid7)
Cloud Security: Experience with cloud-native security tools (AWS Security Hub, Azure Security Center, GCP Security Command Center) and CASB solutions
Identity and Access Management: Strong understanding of IAM platforms, PAM solutions, and identity governance
Comprehensive understanding of federal cybersecurity frameworks and regulations:
NIST Cybersecurity Framework (CSF)
NIST Risk Management Framework (RMF) and NIST 800-53
FISMA, FedRAMP, CMMC, DFARS
DoD Security Technical Implementation Guides (STIGs)
Experience with security assessment and authorization (SA&A) processes and Authority to Operate (ATO) procedures
Strong knowledge of risk assessment methodologies and tools
Proficiency in scripting and automation (Python, PowerShell, Bash)
Experience with Infrastructure as Code (IaC) and security automation (Terraform, Ansible, CloudFormation)
Strong understanding of DevSecOps principles and CI/CD security integration

Nice-to-haves

None flagged.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

awsazuregcppythonci/cddockerkubernetesapi

Platform: jobdiva
Effort: medium

Benefits

Benefits detected in the listing.

Professional Development