Job Openings

ICS Nett, Inc is hiring a highly skilled and experienced Senior ACAS (Assured Compliance Assessment Solution) Engineer to join our dynamic team. The successful candidate will be responsible for the implementation, maintenance, and optimization of our ACAS infrastructure. This role is critical for ensuring the security and compliance of our information systems with DoD and other federal regulations. The ideal candidate will have a strong background in cybersecurity, vulnerability management, and network security. This position will support our Defense Counterintelligence Security Agency (DCSA) program based out of Quantico VA.

The Assured Compliance Assessment Solution (ACAS) Engineer is a critical role responsible for the implementation, maintenance, and operational support of the ACAS suite of tools within the organization. This position focuses on ensuring continuous vulnerability scanning, configuration compliance assessments, and reporting capabilities to maintain a strong security posture and adherence to relevant security policies and regulations (e.g., NIST, DISA STIGs, CIS Benchmarks). The ACAS Engineer will collaborate with other cybersecurity professionals, system administrators, and IT staff to identify vulnerabilities, track remediation efforts, and improve overall security.

Responsibilities:

• ACAS Implementation and Configuration:
• Install, configure, and maintain ACAS components, including Nessus scanners, SecurityCenter/Tenable.sc, and Nessus Network Monitor (NNM).
• Deploy and manage distributed scanning infrastructure across diverse network environments.
• Customize ACAS settings, policies, and scan templates to meet specific organizational requirements.
• Vulnerability Scanning and Analysis:
• Schedule and execute vulnerability scans using Nessus scanners.
• Analyze scan results to identify vulnerabilities, misconfigurations, and security gaps.
• Prioritize vulnerabilities based on severity, exploitability, and potential impact.
• Validate scan findings to minimize false positives.
• Compliance Assessment and Reporting:
• Configure ACAS to perform compliance assessments against industry standards and internal security policies.
• Generate comprehensive reports on vulnerability status, compliance posture, and remediation progress.
• Provide analysis and interpretation of assessment results to stakeholders.
• Develop custom reports and dashboards to visualize security metrics and trends.
• Remediation Support and Tracking:
• Collaborate with system administrators and IT staff to facilitate vulnerability remediation efforts.
• Provide guidance and technical assistance on vulnerability mitigation strategies.
• Track remediation progress and ensure timely resolution of identified issues.
• Re-scan systems to verify remediation effectiveness.
• System Administration and Maintenance:
• Perform system administration tasks for ACAS servers and databases.
• Monitor system performance and troubleshoot any issues.
• Apply security patches and software updates to ACAS components.
• Maintain accurate documentation of ACAS configuration and procedures.
• Threat Intelligence Integration:
• Integrate ACAS with threat intelligence feeds to enhance vulnerability detection capabilities.
• Correlate scan results with threat intelligence data to identify potential exploitation attempts.
• Customize ACAS policies to prioritize vulnerabilities based on threat landscape.
• Training and Documentation:
• Develop and maintain training materials for ACAS users.
• Provide training and support to IT staff on vulnerability management processes.
• Document ACAS procedures, policies, and best practices.
• Continuous Improvement:
• Stay up to date on the latest vulnerability trends and security threats.
• Research and evaluate new ACAS features and capabilities.
• Identify opportunities to improve ACAS effectiveness and efficiency.
• Contribute to the development of security policies and procedures.

The selected candidate will perform robust network security monitoring and proactively identify potential threats across our enterprise infrastructure. This role is critical for defending mission systems, conducting in-depth traffic and vulnerability analysis, and maintaining a strong security posture in support of Department of War (DOW) missions.

The Cyber Defense Analyst (Threat Hunter) is a vital role responsible for performing comprehensive network security monitoring and proactive threat hunting during swing-shift, weekend, and holiday coverage windows. This position focuses on safeguarding the network through continuous traffic analysis, vulnerability and wireless scanning, and leveraging enterprise tools such as SIEM, SOAR, CrowdStrike, CyberArk, and Endpoint Security Suite (ESS).

The Analyst will collaborate with cross-functional IT and security teams to:

• Implement Information Assurance Vulnerability Management (IAVM) programs
• Manage Network Access Control
• Provide insider threat support
• Monitor data at rest
• Review web content filtering
• Maintain and upkeep various cybersecurity applications and tools on servers and workstations to ensure high operational readiness during all covered hours

• Log Analysis & Threat Identification: Experience analyzing log files from network traffic logs, firewall logs, IDS logs, DNS logs and ESS to identify possible security threats (e.g., determine rogue systems, infected systems, unauthorized system changes, and unauthorized hardware connections).
• Policy Enforcement: Ability to identify violations of internet access by reviewing web content filtering logs in accordance with DoD policy, and Standard Operating Procedures (SOPs).
• Task Management: Experience in processing and handling JFHQ DODIN Cyber related tasks to completion.
• Proactive Threat Hunting: Performance of threat hunting activities using DOD approved cyber tools through data hunting, manipulation, and presentation, including generating queries and reports for management and the end-customer.
• Incident Assessment: Validation and confirmation of critical security events and assessing the impact of the event, by incorporating data from multiple tool sources.
• Investigation & Forensics: Identifying evidence of illegal activity involving cybercrime offenses and examining computers that may have been involved in other types of crime or malware infection.
• Malware Analysis: Use of forensic tools and investigative methods to find specific electronic data, namely associated with performing complex malware analysis.
• Process Documentation: Experience developing and maintaining SOPs for security monitoring.
• Reporting: Provide daily/weekly/monthly reports to senior leadership on key indicators of network security.

• Must be able to communicate complex technical ideas to a diverse customer base, both verbally and in written form.

ICS Nett, Inc is seeking a highly skilled Zero Trust Engineer III with a specialized focus on Enterprise Architecture and Identity, Credential, and Access Management (ICAM). The successful candidate will be the primary technical authority for designing, integrating, and maturing the enterprise Zero Trust Architecture (ZTA) in support of critical Department of War (DoW) missions. This role requires a strategic thinker who can develop a holistic enterprise-level security architecture grounded in Zero Trust principles. The position will be responsible for ensuring that ICAM is the central pillar of our security posture, protecting critical infrastructure and CUI within Impact Level 5 (IL5) environments. The ideal candidate will possess deep expertise in the DoW Zero Trust Strategy, enterprise architecture frameworks, and the implementation of advanced ICAM solutions. This position will support our DCSA Contract based in Quantico VA.

As a Zero Trust Engineer III, you will be a critical leader in our transition from traditional perimeter-based security to a comprehensive, identity-driven security model. Your primary focus will be on the enterprise architecture of our Zero Trust ecosystem, ensuring all security solutions and pillars — User, Device, Network, Application/Workload, Data, Visibility, and Automation/Orchestration — are cohesive, scalable, and fully integrated. You will leverage your expertise in Enterprise Architecture to develop and maintain the overall structure of the ZTA, while using your deep knowledge of ICAM to enforce granular, dynamic access control across the enterprise. This role involves close collaboration with mission owners, cybersecurity professionals, and IT staff to build a resilient and unified security framework that adheres strictly to the DoW Zero Trust Strategy.

• Enterprise Architecture & Strategy::
• Develop and maintain the overarching Zero Trust Enterprise Architecture, ensuring alignment with DoW mission requirements, DTM 25-003, the DoW Zero Trust Reference Architecture, and NIST SP 800-207.
• Create and manage strategic roadmaps for transitioning legacy systems into a fully integrated ZTA, minimizing disruption and maximizing security benefits
• Serve as the lead technical architect for all Zero Trust initiatives, ensuring architectural integrity and consistency across projects.
• Identity, Credential, and Access Management (ICAM):
• Architect and lead the implementation of a robust, enterprise-wide ICAM framework as the foundation of the Zero Trust model.
• Design and enforce advanced Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) policies to ensure least-privilege access.
• Engineer solutions for continuous authentication, conditional access, and privileged access management (PAM) across all enterprise assets.
• Network and Infrastructure Security:
• Integrate network security solutions like micro-segmentation, Software-Defined Perimeters (SDP), and SASE into the broader Zero Trust Enterprise Architecture.
• Ensure network designs are governed by ICAM policies to restrict lateral movement and enforce access control at the network layer.
• Data Security and Governance:
• Design an enterprise data governance strategy that aligns with Zero Trust principles, focusing on data discovery, classification, and protection of CUI.
• Architect data security controls where access is determined by user identity, device posture, and data context, ensuring encryption for data at rest and in transit.
• Collaboration and Compliance:
• Provide expert guidance on Zero Trust Enterprise Architecture to leadership, engineering teams, and mission stakeholders.
• Ensure all architectural designs are compliant with the Risk Management Framework (RMF) and relevant DISA STIGs.
• Visibility, Analytics, and Automation:
• Integrate Zero Trust telemetry with enterprise SIEM and continuous monitoring solutions.
• Develop architectures that support automated threat response and continuous risk scoring.
• Work with SOC analysts to ensure visibility gaps are closed across all endpoints and network segments.
• Continuous Improvement:
• Stay up-to-date with the latest Zero Trust technologies, DoW policies, and adversary tactics.
• Research and evaluate new vendor solutions to enhance enterprise security capabilities.
• Document architectural standards, concept of operations (CONOPS), and best practices.

The Cyber Defense Auditor uses a documented test plan and methodology and a variety of approved tools to conduct penetration tests and red/blue team operations for customer systems supporting the Defense Counterintelligence and Security Agency (DCSA) Hanover, MD.

Responsibilities:

• Develop enterprise Red / Blue team plans and testing schedules
• Brief results of penetration testing activities
• Simulate internal lateral movement activities observed in successful attacks
• Identify and report security deficiencies
• Provide advisement on countermeasures to mitigate threats
• Provide vulnerability-to-exploit mapping
• Perform system post-implementation security posture determination
• Provide penetration testing services in support of continuous diagnostic mitigation process
• Maintain overall tracker of penetration testing activities
• Perform Red / Blue Team scenarios, planning, operations, and reporting

ICS Nett, Inc is hiring a Cyber Incident Responder to join our dynamic team for swing shift from 2.00 PM to Midnight to provide support, including weekends and holidays, on rotation. This is an on-site position at Hanover, MD.

The candidate will serve as a front-line defender, detecting, triaging, containing, and eradicating cyber threats across our enterprise infrastructure. This role is critical for minimizing the impact of security incidents, coordinating response actions, and preserving forensic evidence in support of Department of Defense (DoD) missions.

Position Description

The Cyber Incident Responder will play an important role in executing the full incident response lifecycle during swing-shift, weekend, and holiday coverage windows. This position focuses on detecting and responding to security incidents in real time, performing containment and eradication actions, and coordinating recovery efforts using enterprise tools such as SIEM, SOAR, CrowdStrike, CyberArk, and Endpoint Security Suite (ESS).

The Incident Responder will collaborate with cross-functional IT and security teams to:

• Execute incident response procedures in accordance with NIST SP 800-61 and DoD guidelines

• Coordinate with JFHQ-DODIN on cyber incident reporting and remediation
• Support insider threat response and investigations
• Contain and remediate compromised systems, accounts, and endpoints
• Preserve and document forensic evidence for incident case management

Maintain incident response playbooks and ensure high operational readiness during all covered hours

ICS is seeking a highly skilled Zero Trust Engineer III with a specialized focus on Enterprise Architecture and Identity, Credential, and Access Management (ICAM). The successful candidate will be the primary technical authority for designing, integrating, and maturing the enterprise Zero Trust Architecture (ZTA) in support of critical Department of War (DoW) missions. This role requires a strategic thinker who can develop a holistic enterprise-level security architecture grounded in Zero Trust principles. The position will be responsible for ensuring that ICAM is the central pillar of our security posture, protecting critical infrastructure and CUI within Impact Level 5 (IL5) environments. The ideal candidate will possess deep expertise in the DoW Zero Trust Strategy, enterprise architecture frameworks, and the implementation of advanced ICAM solutions. This position will support our DCSA Contract based in Quantico VA.

Position Description:

As a Zero Trust Engineer III, you will be a critical leader in our transition from traditional perimeter-based security to a comprehensive, identity-driven security model. Your primary focus will be on the enterprise architecture of our Zero Trust ecosystem, ensuring all security solutions and pillars — User, Device, Network, Application/Workload, Data, Visibility, and Automation/Orchestration — are cohesive, scalable, and fully integrated. You will leverage your expertise in Enterprise Architecture to develop and maintain the overall structure of the ZTA, while using your deep knowledge of ICAM to enforce granular, dynamic access control across the enterprise. This role involves close collaboration with mission owners, cybersecurity professionals, and IT staff to build a resilient and unified security framework that adheres strictly to the DoW Zero Trust Strategy.

Key Responsibilities:

• Enterprise Architecture & Strategy::
  • Develop and maintain the overarching Zero Trust Enterprise Architecture, ensuring alignment with DoW mission requirements, DTM 25-003, the DoW Zero Trust Reference Architecture, and NIST SP 800-207.
  • Create and manage strategic roadmaps for transitioning legacy systems into a fully integrated ZTA, minimizing disruption and maximizing security benefits.
  • Serve as the lead technical architect for all Zero Trust initiatives, ensuring architectural integrity and consistency across projects.
• Identity, Credential, and Access Management (ICAM):
  • Architect and lead the implementation of a robust, enterprise-wide ICAM framework as the foundation of the Zero Trust model.
  • Design and enforce advanced Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) policies to ensure least-privilege access.
  • Engineer solutions for continuous authentication, conditional access, and privileged access management (PAM) across all enterprise assets.
• Network and Infrastructure Security:
  • Integrate network security solutions like micro-segmentation, Software-Defined Perimeters (SDP), and SASE into the broader Zero Trust Enterprise Architecture.
  • Ensure network designs are governed by ICAM policies to restrict lateral movement and enforce access control at the network layer.
• Data Security and Governance:
  • Design an enterprise data governance strategy that aligns with Zero Trust principles, focusing on data discovery, classification, and protection of CUI.
  • Architect data security controls where access is determined by user identity, device posture, and data context, ensuring encryption for data at rest and in transit.
• Collaboration and Compliance:
  • Provide expert guidance on Zero Trust Enterprise Architecture to leadership, engineering teams, and mission stakeholders.
  • Ensure all architectural designs are compliant with the Risk Management Framework (RMF) and relevant DISA STIGs.
• Visibility, Analytics, and Automation:
  • Integrate Zero Trust telemetry with enterprise SIEM and continuous monitoring solutions.
  • Develop architectures that support automated threat response and continuous risk scoring.
  • Work with SOC analysts to ensure visibility gaps are closed across all endpoints and network segments.
• Continuous Improvement:
  • Stay up-to-date with the latest Zero Trust technologies, DoW policies, and adversary tactics.
  • Research and evaluate new vendor solutions to enhance enterprise security capabilities.
  • Document architectural standards, concept of operations (CONOPS), and best practices.