IT Security Operations Specialist

Tharros supports the Department of Homeland Security (DHS) with cybersecurity services across its Intelligence Enterprise. To support this mission, we have an immediate opening for an IT Security Operations Specialist.

In this role, you will run day-to-day IT security programs inside DHS SCIFs, including SCI incident reporting, privileged user tracking, removable media management, equipment entry/exit and decommissioning, and IT security training and outreach. This position is on-site in a Government SCIF in Washington, DC.

• Identify, record, and report SCI IT security incidents in the GRC tool and to the DHS Enterprise SOC and IC Security Coordination Center.
• Maintain the privileged user database; issue annual training memos and 30/60/90-day compliance reminders.

• Monitor and identify potential SCI IT security incidents, including unauthorized access, security policy violations, suspicious system activity, data spillage, unauthorized media usage, and potential compromises of classified information systems.

• Document, categorize, and track security incidents within the Governance, Risk, and Compliance (GRC) tool, ensuring accurate incident descriptions, supporting evidence, affected systems, severity assessments, and remediation activities.

• Report identified or suspected security incidents to the DHS Enterprise Security Operations Center (SOC) and Intelligence Community Security Coordination Center (IC SCC) in accordance with established reporting timelines, escalation procedures, and classification requirements.

• Coordinate with Information System Security Officers (ISSOs), Information System Security Managers (ISSMs), SOC analysts, system administrators, and other security stakeholders to investigate incidents, assess potential impacts, and support containment and remediation efforts.

• Maintain comprehensive incident records, including investigative findings, corrective actions, incident status, and closure documentation, to support compliance reviews, audits, and continuous monitoring requirements.

• Administer the Removable Media Program in accordance with ICS 500-18, including training, waivers, Rules of Behavior, and tracking.
• Inspect IT equipment entering and exiting SCIFs; review pre-procurement and PED request forms.
• Coordinate sanitization and decommissioning in accordance with DHS 4300C and NSA/CSS Policy Manual 9-12.
• Manage daily operations of the SCIF compliance oversight program (ICOP) and ISCR/ISSO designations.
• Develop and update annual SCI IT security awareness, removable media, and privileged user training; deliver classroom sessions.
• Produce IT security tips, newsletters, surveys, and briefings for non-technical audiences.

Requirements:

• BS degree in Information Technology, Cybersecurity, Information Systems, or Computer Science OR minimum of 6 years' experience in IT or security operations.
• Minimum of 3 years' experience in IT security operations, SCIF compliance, or security program administration.
• Active Top Secret clearance with contingency on DOD CAS granting SCI eligibility.
• Knowledge of ICS 500-18 removable media requirements.
• Knowledge of SCIF IT equipment entry/exit, sanitization, and decommissioning procedures.
• Knowledge of security incident reporting and handling processes.
• Skill in maintaining compliance databases and producing metrics reports.
• Skill in developing training materials and briefing non-technical audiences.
• Ability to manage multiple recurring compliance programs and deadlines.
• Proficient in Microsoft Office Suite, including Teams or similar workplace chat and videoconferencing tools.
• Excellent written and oral communication skills.

Desired

• Experience with NSA/CSS media sanitization procedures.
• LMS administration or instructional design experience.
• Familiarity with COMSEC to serve as a backup for two-person integrity.
• CompTIA Security+ certification.