Cybersecurity Analyst/Engineer

• Develop, maintain, and test Incident Response (IR) and Disaster Recovery (DR) plans; lead tabletop exercises with IT and operations stakeholders
• Serve as the primary point of contact for security incidents; coordinate containment, investigation, and post-incident remediation

• Administer and mature the ISO 27001 control environment; maintain a current Statement of Applicability, evidence library, and audit trail
• Support DFARS/CMMC readiness efforts as contract requirements evolve, coordinating with Legal and external advisors as needed
• Enforce and document adherence to NIST CSF and relevant federal compliance frameworks across PCS and ASM environments

• Review and enforce Conditional Access policies, MFA enrollment, and privileged access controls; ensure Entra ID configurations align with least-privilege principles
• Oversee endpoint compliance posture (Intune/MEM) and enforce security baselines across Windows endpoints

• Conduct third-party and vendor security risk assessments; maintain a vendor risk register and drive remediation of identified gaps
• Develop and deliver security awareness training and phishing simulation programs for all shore-based personnel
• Design and deliver targeted anti-fraud training for Finance, Accounting, and HR staff covering business email compromise (BEC), invoice fraud, payroll diversion, and vendor impersonation schemes

• Monitor email, financial, and payroll systems for indicators of business email compromise, invoice manipulation, wire fraud, and vendor/banking-detail change schemes
• Partner with Finance, Accounting, and HR to establish and enforce verification controls for wire transfers, vendor payment changes, and payroll modifications
• Configure and maintain email authentication and anti-spoofing controls (SPF, DKIM, DMARC) and mailflow rules to reduce phishing and impersonation exposure
• Investigate suspected fraud incidents in coordination with Finance, Legal, and law enforcement as needed; support recovery efforts and post-incident control improvements
• Stay current on emerging cyber fraud tactics (deepfake/voice-cloning impersonation, social engineering, account takeover) and proactively adapt controls and training accordingly

• Produce recurring executive security dashboards and risk metrics for President, CFO, and senior leadership review
• Translate technical risk into business language; contribute to contract-level security disclosures and compliance reporting as required

• 3–5+ years of hands-on experience in cybersecurity or information security engineering; mid-to-senior level background required
• Demonstrated experience in a federal government contractor, defense, or similarly regulated environment strongly preferred
• Prior experience with CMMC framework requirements is required
• Hands-on proficiency with the Microsoft security stack: Sentinel (SIEM/SOAR), Defender for Endpoint, Defender for Cloud, Entra ID, and Conditional Access
• Working knowledge of Azure security services, cloud posture management (CSPM), and hybrid infrastructure environments
• Working knowledge of NIST CSF, ISO 27001, DFARS 252.204-7012, and CMMC 2.0 framework requirements
• Ability to maintain audit-ready documentation, evidence libraries, and control mapping artifacts
• Strong written and oral communication skills; ability to translate technical risk into business-level language for executive audiences
• Demonstrated experience identifying, investigating, and mitigating cyber-enabled fraud, including business email compromise (BEC), invoice fraud, and payment diversion schemes

• CISSP, CISM, CompTIA Security+, or Microsoft SC-200 / SC-300 certification (candidates with equivalent demonstrated experience will be considered)
• Experience with vulnerability scanning platforms (e.g., Nessus, Qualys, Defender Vulnerability Management) and endpoint management via Intune/MEM
• Familiarity with ERP security configurations or experience supporting an active ERP migration environment
• Experience in a maritime, transportation, or DoD-adjacent operating environment
• Certified Fraud Examiner (CFE) or equivalent fraud investigation/financial crimes credential
• Security clearance eligibility (Secret preferred)

Patriot offers a competitive total compensation package commensurate with experience, including:

• Comprehensive health benefits: Medical, Dental, and Vision
• Life insurance and disability coverage
• 401(k) retirement plan with employer contribution
• Paid time off, holidays, and sick leave per company policy