Run and maintain an enterprise Burp Suite DAST program, including authenticated scans, CI/CD integrations, and Linux troubleshooting. Use Veracode SAST and development tools to integrate security testing into pipelines. Design enterprise security controls, assess web applications against OWASP and related standards, and align security activities with NIST, FIPS, and FedRAMP requirements. The role supports a federal financial regulatory agency and requires U.S. citizenship and Public Trust suitability.

Leads Tier 3 incident response for APT, financially motivated, and AWS cloud threats. Investigates, contains, and remediates incidents using Splunk, SOAR, Microsoft Defender EDR, AWS telemetry, MITRE ATT&CK, and NIST 800-61. Mentors analysts, reviews and authors incident reports, improves IR processes, supports audits, and serves in a weekly after-hours on-call rotation while working directly with government clients.

Build, customize, and maintain secure configuration baselines using CIS Benchmarks and DISA STIGs. Map technical settings to FISMA and NIST controls, develop baselines from vendor documentation, apply NVD and CVE data, and verify compliance through Tenable scans. The role requires independent ownership, collaboration with system teams, clear risk communication, and support for baseline rollout across servers, networks, cloud, SaaS, and mobile platforms.