Cyber Tools Lead

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Full Time Professional Washington, DC, US

3 days ago Requisition

Paragon Technology Group is seeking an experienced Cyber Tools Lead (CTL) to provide technical leadership and subject matter expertise for the operation, integration, modernization, and lifecycle management of an enterprise cybersecurity tool ecosystem supporting a Federal Government customer.

The Cyber Tools Lead will serve as the primary contractor technical lead for cybersecurity tools, providing technical direction to cybersecurity engineers, tool administrators, developers, and other technical personnel. The CTL will lead the architecture, engineering, integration, deployment, configuration, operation, maintenance, and optimization of cybersecurity tools and supporting technologies.

The successful candidate will be responsible for ensuring cybersecurity tools are reliable, integrated, securely configured, and optimized to support security operations, vulnerability management, continuous monitoring, risk management, compliance, and incident detection and response.

• Lead the architecture, engineering, integration, deployment, configuration, operation, maintenance, and optimization of enterprise cybersecurity tools and supporting technologies.
• Provide technical leadership and oversight to cybersecurity engineers, tool administrators, developers, and other technical personnel.
• Maintain cybersecurity tool architectures, configuration standards, integration requirements, deployment plans, operating procedures, and maintenance plans.
• Manage and optimize capabilities supporting SIEM/log analytics, EDR/XDR, SOAR, vulnerability management, cloud security posture management, identity security monitoring, and service-management/ticketing integration.
• Monitor tool health, availability, connector status, data ingestion, storage, capacity, licensing, and integration performance and lead resolution of outages, degradation, and other technical issues.
• Lead upgrades, patches, migrations, modernization, technology refresh, and replacement activities while maintaining operational continuity.
• Coordinate testing and validation of new tools, configurations, integrations, upgrades, patches, and releases prior to production implementation.
• Lead integration of cybersecurity tools with enterprise infrastructure, cloud environments, applications, databases, identity services, security platforms, ticketing systems, dashboards, and other Government systems.
• Develop and maintain APIs, connectors, data feeds, automation, and other mechanisms necessary to exchange cybersecurity information across systems and tools.
• Support onboarding, validation, normalization, and monitoring of security telemetry and identify and resolve logging gaps, parser issues, ingestion failures, and data-quality problems.
• Lead development, testing, tuning, and implementation of detection content, automation playbooks, scripts, workflows, and integrations designed to improve threat detection and response and reduce manual analyst effort.
• Support vulnerability management capabilities, including vulnerability scanning, asset correlation, scan coverage, remediation tracking, dashboards, metrics, and reporting.
• Support cloud security posture management, including security baselines, cloud logging, identity events, configuration findings, detection content, and compliance reporting.
• Develop and maintain dashboards, metrics, reports, and automated workflows that provide stakeholders with visibility into cybersecurity posture, vulnerabilities, risks, compliance, and operational performance.
• Identify opportunities to automate repetitive cybersecurity processes, improve data accuracy, reduce manual effort, and increase operational efficiency.
• Ensure cybersecurity tools are configured and maintained in accordance with applicable Federal cybersecurity requirements, Department policies, Government security standards, vendor guidance, and approved technical baselines.
• Support cybersecurity tool security assessments, authorization activities, vulnerability remediation, configuration management, change management, and continuous monitoring.
• Coordinate cybersecurity tool requirements and activities with system owners, ISSOs, security engineers, network and cloud teams, application teams, enterprise architects, cybersecurity operations personnel, vendors, and other stakeholders.
• Identify technical risks, dependencies, capability gaps, end-of-life technologies, and other issues affecting the cybersecurity tool environment and recommend mitigation strategies.
• Evaluate emerging cybersecurity technologies and provide recommendations concerning adoption, integration, consolidation, modernization, or replacement of existing capabilities.
• Support cybersecurity tool acquisition and technical evaluations, including development and review of technical requirements,…