IT Security and Systems Specialist

We are seeking an experienced IT Security and Systems Specialist to lead all Corporate IT functions for our organization of approx. 150 employees. This is a standalone, high-impact role supporting our HQ team and a distributed workforce at government organizations nationwide. In this role you will own our technical roadmap, ensuring our systems are high performing, * Standalone IT Leadership: Own the technical roadmap for FedGeek. Manage all IT operations, including hardware procurement, software configuration, network administration, and cloud services (Microsoft 365).

• CMMC & Cybersecurity: Lead the organization through the CMMC 2.0 re-certification process. Maintain the System Security Plan (SSP) and POAM, ensuring all 110 NIST controls are technically implemented and documented.
• Continuous Monitoring & Vulnerability Management: Conduct regular vulnerability scanning, log reviews, and patch management across all endpoints and cloud infrastructure to ensure continuous compliance with NIST SP 800-171.
• Microsoft 365 & Email Integration: Administer our M365 tenant (GCC/GCC High) with a focus on secure email integration, identity management (Entra ID), and data loss prevention (DLP).
• Access Control & Identity Governance: Configure, enforce, and audit strict Conditional Access policies, Multi-Factor Authentication (MFA), and Least Privilege access across M365 (GCC/GCC High) and Google Workspace.
• FIPS-Validated Encryption Oversight: Ensure all cryptographic modules used for CUI at rest and in transit (VPNs, BitLocker, TLS configurations) are strictly FIPS 140-2/3 validated and compliant.
• GFE Liaison & Support: Provide expert-level support for a workforce primarily using

Government Furnished Equipment (GFE). You'll ensure our secure email integrations and apps work seamlessly on government-issued devices.

• Remote Workforce Support: Provide hands-on and remote technical support for approx. 150 employees stationed at various government sites nationwide, ensuring secure and reliable connectivity and including on-boarding and off-boarding IT support and management of corporate assets.
• Endpoint Management: Deploy and manage all company assets and ensure disk encryption, MFA, and automated patching are strictly enforced.
• Incident Response & Reporting: Maintain, test, and execute the company's Incident Response Plan, ensuring proper logging, tracking, and alignment with DFARS reporting requirements (e.g., reporting incidents to DIBNet within 72 hours).
• Vendor & Supply Chain Risk Management: Assess and monitor the CMMC compliance postures of critical third-party vendors and subcontractors who may handle FedGeek data.
• Audit Representation: Serve as the primary technical point of contact for government audits and third-party (C3PAO) assessments.
• A tech professional with a knack for building clever, AI-powered workarounds.
• Genuine curiosity and adaptability to experiment with new AI tools and APIs as they evolve.

• Experience: Minimum 5+ years of IT experience, with a background in a government contracting environment (Federal preferred).
• Technical Mastery: Proven experience implementing CMMC or NIST 800-171 security frameworks.
• Audit Experience: Direct experience participating in or leading a formal DIBCAC or C3PAO assessment (not just a self-assessment).
• Documentation Mastery: Proven track record of drafting, updating, and defending a System Security Plan (SSP) and managing a Plan of Action and Milestones (POA&M).
• Technical Stack Experience: Deep technical hands-on experience with Microsoft Purview (for data classification and labeling), Microsoft Defender for Endpoint/Cloud, and Azure Information Protection (AIP).
• Cross-Platform Data Sovereignty: Enforce strict data boundaries and cryptographic isolation between Microsoft 365 (GCC High) and Google Workspace. Architect and maintain controls ensuring Controlled Unclassified Information (CUI) and

Export-Controlled data (ITAR/EAR) are strictly barred from non-compliant cloud repositories and restricted to authorized US Persons.

• Communication: Ability to work independently while effectively communicating technical risks to leadership.
• Location: DC/Maryland/Virginia area (preferably or remote).
• Preferred Certifications:
• Certified CMMC Professional (CCP) or Certified CMMC Assessor (CCA)
• CISSP (Certified Information Systems Security Professional)
• CompTIA Security+ / CySA+

4.04.0 out of 5 stars Leesburg, VA 20175 Hybrid work $90,000 - $115,000 a year - Full-time, Pulled from the full job description

• Referral program
• Professional development assistance
• Tuition reimbursement
• 401(k)
• Health insurance
• 401(k) matching
• Paid time off, * 401(k)
• 401(k) matching
• Dental insurance
• Employee assistance program
• Employee discount
• Flexible spending account
• Health insurance
• Health savings account
• Life insurance
• Paid time off
• Professional development assistance
• Referral program
• Tuition reimbursement
• Vision insurance

FedGeek has a different kind of culture. We value passion, collaboration, creativity, and action. We hold ourselves to a higher standard and bring a rare energy and commitment to our projects. We are an Woman-Owned Small Business (WOSB) with a 19-year track record of excellence. Supporting multiple agencies across the federal landscape, we deliver specialized program management, application development, science and technology services.