Cybersecurity Blue Team Analyst – Senior

ADP, Inc.; Chantilly (VA); On-site; USD 130,000 - 170,000; Full time

Job summary

ADP, Inc. in Chantilly, VA seeks a Senior Cybersecurity Blue Team Analyst to act as a technical authority for defensive operations across complex enterprise IT environments.

You will lead assessments of infrastructure, cloud, networks, and security architectures, and translate findings into practical remediation strategies. The role requires deep experience with SIEM/EDR/XDR, vulnerability management, threat hunting, and the ability to mentor junior staff and communicate with senior leadership.

Qualifications

• 7+ years of experience in cybersecurity, defensive cyber operations, security engineering, information assurance, vulnerability management, or related field.
• Demonstrated ability to lead cybersecurity assessments across diverse and complex enterprise IT environments.
• Expert knowledge of enterprise network architecture, operating systems, cloud computing, virtualization, applications, databases, IAM, and cybersecurity technologies.
• Demonstrated experience with SIEM, EDR/XDR, vulnerability management, network security, threat hunting, incident response, and security analytics technologies.
• Expert knowledge of NIST SP 800-53, NIST SP 800-37, RMF, STIGs, CIS benchmarks, and related cybersecurity standards and practices.
• Ability to evaluate technical and architectural risks across multiple interconnected systems and technology domains.
• Must hold Top Secret security clearance. Counterintelligence polygraph desired.

Responsibilities

• Lead comprehensive cybersecurity assessments across complex enterprise IT environments.
• Assess security architecture, controls, configurations, operational practices, and telemetry across on-premises, cloud, hybrid, and distributed environments.
• Evaluate security of networks, Windows and Linux infrastructure, endpoints, apps, databases, virtualization, cloud services, IAM, and security-management platforms.
• Lead vulnerability assessments, configuration reviews, security-control assessments, threat hunts, and defensive cyber assessments.
• Analyze complex security events and telemetry to identify sophisticated attacks, lateral movement, persistence, and exfiltration.
• Correlate information across SIEM, EDR/XDR, network, identity, cloud, app, vulnerability-management, and infrastructure-management platforms.
• Lead investigations of significant incidents and provide direction for containment, eradication, and recovery.
• Develop remediation strategies and prioritize findings by impact and exploitability.
• Mentor and provide technical leadership to entry- and mid-level analysts.
• Translate technical findings into actionable recommendations for government and senior technical leadership.
• Review and approve assessment plans, findings, reports, and remediation recommendations.
• Serve as SME on enterprise defensive cybersecurity and threat detection.
• Track emerging vulnerabilities and attack techniques to improve capabilities.

Skills

Cybersecurity

Security assessments

Leadership

Technical writing

Tools

SIEM

EDR/XDR

Vulnerability management

Network security

Threat hunting

Incident response

Security analytics

Job description

If you are unable to complete this application due to a disability, contact this employer to ask for an accommodation or an alternative application process.

Cybersecurity Blue Team Analyst – Senior

Chantilly, VA, US

Minimum Qualifications:

The Senior Cybersecurity Blue Team Analyst serves as a technical authority for cybersecurity assessment and defensive cyber operations across complex enterprise IT environments. The analyst leads assessments of infrastructure, applications, networks, cloud environments, security architectures, and enterprise services; evaluates systemic cybersecurity risk; and develops actionable recommendations to improve the organization's defensive posture.

Responsibilities:

• Lead comprehensive cybersecurity assessments across complex, heterogeneous enterprise IT environments.
• Assess security architecture, controls, configurations, operational practices, and telemetry across on-premises, cloud, hybrid, and distributed environments.
• Evaluate security of enterprise networks, Windows and Linux infrastructure, endpoints, applications, databases, virtualization platforms, cloud services, identity and access management systems, network-security infrastructure, and security-management platforms.
• Lead vulnerability assessments, configuration reviews, security-control assessments, threat hunts, and defensive cyber assessments.
• Analyze complex security events and telemetry to identify sophisticated attacks, lateral movement, persistence mechanisms, privilege escalation, data exfiltration, and other adversary behaviors.
• Correlate information across SIEM, EDR/XDR, network, identity, cloud, application, vulnerability-management, and infrastructure-management platforms.
• Lead investigations of significant cybersecurity incidents and provide technical direction for containment, eradication, recovery, and lessons learned.
• Evaluate enterprise attack surfaces and identify systemic weaknesses spanning multiple systems or technology domains.
• Develop risk-based remediation strategies and prioritize findings based on mission impact, exploitability, exposure, and adversary activity.
• Lead development and improvement of cybersecurity assessment methodologies, automated assessment capabilities, detection strategies, and defensive analytics.
• Translate technical findings into actionable recommendations for government and senior technical leadership.
• Review and approve assessment plans, technical findings, reports, and remediation recommendations developed by other analysts.
• Mentor and provide technical leadership to entry- and intermediate-level analysts.
• Serve as a subject-matter expert on enterprise defensive cybersecurity, security assessment, vulnerability management, and threat detection.
• Track emerging vulnerabilities, attack techniques, adversary TTPs, and changes in enterprise technology to continuously improve assessment and defensive capabilities.

Required Qualifications:

• 7+ years of experience in cybersecurity, defensive cyber operations, security engineering, information assurance, vulnerability management, or a related field.
• Demonstrated ability to lead cybersecurity assessments across diverse and complex enterprise IT environments.
• Expert knowledge of enterprise network architecture, operating systems, cloud computing, virtualization, applications, databases, identity and access management, and cybersecurity technologies.
• Demonstrated experience with SIEM, EDR/XDR, vulnerability management, network security, threat hunting, incident response, and security analytics technologies.
• Expert knowledge of NIST SP 800-53, NIST SP 800-37, RMF, STIGs, CIS benchmarks, and related cybersecurity standards and practices.
• Ability to evaluate technical and architectural risks across multiple interconnected systems and technology domains.
• Strong technical writing, briefing, analytical, and leadership skills.
• Must hold Top Secret security clearance. Counterintelligence polygraph desired.