Cyber Security Network Platform Subject Matter Expert

Cyber Security Network Platform Subject Matter Expert

Argo Cyber Systems, LLC | Federal Cybersecurity Operations

Security Clearance: Active Top Secret / SCI (TS/SCI) Required Citizenship: U.S. Citizenship Required Suitability: Must be able to obtain DHS Suitability Experience Level: Senior / Subject Matter Expert Work Location: To Be Confirmed

Position Overview

Argo Cyber Systems is seeking an experienced Cyber Security Network Platform Subject Matter Expert (SME) to support a mission-critical U.S. Government cybersecurity program focused on defending federal civilian agencies and critical infrastructure against sophisticated cyber threats.

In this role, you will help shape the future of AI-enabled cybersecurity by identifying, evaluating, and implementing artificial intelligence and machine learning capabilities that enhance threat detection, incident response, threat hunting, and security operations.

The ideal candidate combines deep cybersecurity expertise with practical AI/ML knowledge, strategic planning capabilities, and technical leadership experience. You will work across security operations, engineering, data science, and government stakeholder teams to translate emerging AI technologies into actionable, mission-focused security capabilities.

This position offers an opportunity to directly influence how AI technologies are adopted and operationalized to strengthen the nation's cybersecurity defenses.

Key Responsibilities

AI Security Strategy and Innovation

• Develop and advance strategic roadmaps for AI-enabled cybersecurity capabilities aligned with organizational objectives and risk posture.

• Identify high-value AI/ML use cases across security operations, threat detection, incident response, vulnerability management, and cyber threat intelligence.

• Evaluate emerging AI technologies, platforms, and solutions for operational effectiveness and mission applicability.

• Assess AI-enabled threats, adversarial machine learning techniques, and emerging risks associated with AI adoption.

• Recommend AI prototypes, pilot programs, and proof-of-concept initiatives that improve cyber defense effectiveness.

Cybersecurity Architecture and AI Integration

• Translate operational cybersecurity requirements into actionable AI/ML solution specifications.

• Collaborate with cybersecurity analysts, data scientists, engineers, and infrastructure teams to design and implement AI-enabled security capabilities.

• Evaluate opportunities to incorporate AI into SIEM, SOAR, threat hunting, security analytics, and automated incident response workflows.

• Assess AI adoption readiness, technical dependencies, operational risks, and integration requirements.

• Ensure proposed solutions satisfy applicable security, privacy, governance, and compliance requirements.

• Apply knowledge of AI model training, validation, deployment, and lifecycle management to security-focused implementations.

Program and Project Leadership

• Develop comprehensive implementation roadmaps with defined milestones, schedules, dependencies, and measurable outcomes.

• Lead cross-functional AI cybersecurity initiatives involving security operations, engineering, data science, and government stakeholders.

• Develop project schedules, resource estimates, and budget recommendations.

• Identify program risks, track implementation progress, and develop mitigation strategies.

• Coordinate technical and operational workstreams to support successful AI integration.

• Apply Agile, Waterfall, or hybrid project management methodologies as appropriate.

Stakeholder Engagement and Operational Adoption

• Serve as a trusted technical advisor to cybersecurity leadership and government stakeholders.

• Communicate complex AI and cybersecurity concepts to both technical and nontechnical audiences.

• Present recommendations, implementation progress, operational risks, and strategic opportunities to senior leadership.

• Develop performance metrics and KPIs to evaluate the effectiveness of AI-enabled security capabilities.

• Support change management, workforce readiness, training, documentation, and knowledge transfer.

• Promote practical and responsible adoption of AI technologies within established cybersecurity operations.

Required Qualifications

Security and Eligibility

• U.S. Citizenship is required.

• Active Top Secret / Sensitive Compartmented Information (TS/SCI) security clearance is required.

• Must be able to obtain DHS Suitability.

Professional Experience

• Minimum 10 years of directly relevant professional experience.

• Minimum 5 years of experience in cybersecurity or related technical disciplines.

• Minimum 3 years of experience working with artificial intelligence, machine learning, or data-driven security solutions.

• Minimum 3 years of experience in project management, program management, or technical leadership.

Technical and Leadership Skills

• Strong understanding of AI/ML fundamentals, including neural networks, natural language processing, model training, validation, and deployment.

• Extensive knowledge of cybersecurity operations, cyber threat landscapes, security architecture, and defensive technologies.

• Working knowledge of MITRE ATT&CK, SIEM/SOAR platforms, and security operations workflows.

• Familiarity with behavioral analytics, threat hunting, malware analysis, phishing detection, and vulnerability management.

• Demonstrated ability to identify practical AI applications and translate technical concepts into operational solutions.

• Experience developing technology roadmaps and managing complex technical initiatives.

• Proficiency with Agile, Waterfall, or hybrid project management approaches.

• Experience using project management platforms such as Jira, Microsoft Project, Asana, or comparable tools.

• Strong communication, analytical thinking, stakeholder engagement, and technical leadership skills.

• Ability to influence multidisciplinary teams and operate effectively in rapidly evolving technical environments.

Preferred Qualifications

Candidates with the following experience are especially encouraged to apply:

• Experience securing AI systems and implementing AI-enabled cybersecurity solutions within Security Operations Centers (SOCs).

• Experience identifying, analyzing, or defending against AI-enabled cyberattacks and adversarial AI techniques.

• Background in security analytics, data engineering, cyber threat intelligence, or security automation.

• Experience with cloud security technologies across Microsoft Azure, Amazon Web Services (AWS), or Google Cloud Platform (GCP).

• Knowledge of AI governance, responsible AI practices, ethical AI principles, and associated security considerations.

• Familiarity with privacy and regulatory requirements, including GDPR, CCPA, or industry-specific security frameworks.

• Experience with security automation, orchestration, and integration technologies.

Education Requirements

Required: Bachelor's degree in Computer Science, Cybersecurity, Engineering, Information Systems, or a related technical field.

Preferred: Master's degree in a relevant technical discipline.

Desired Professional Certifications

One or more of the following certifications is preferred:

• Certified Information Systems Security Professional (CISSP)

• Certified Information Security Manager (CISM)

• Project Management Professional (PMP)

• PMI Agile Certified Practitioner (PMI-ACP)

• Relevant Artificial Intelligence or Machine Learning certifications

Why Join Argo Cyber Systems?

At Argo Cyber Systems, our professionals support cybersecurity missions that protect federal agencies, critical infrastructure, and essential government services.

As an SBA-certified Service-Disabled Veteran-Owned Small Business (SDVOSB), Argo Cyber Systems brings mission-focused cybersecurity expertise and a commitment to technical excellence.

Joining our team provides an opportunity to:

• Support high-impact cybersecurity operations protecting U.S. Government systems and critical infrastructure.

• Help advance the adoption of AI and machine learning within operational cyber defense environments.

• Collaborate with experienced cybersecurity professionals, engineers, and technical leaders.

• Contribute to innovative solutions addressing evolving cyber threats.

• Work within a mission-driven organization that values technical expertise, accountability, and professional development.

The DHS Hunt and Incident Response Team (HIRT) secures the nation's infrastructure. HIRT provides DHS's front-line response for cyber incidents and proactive hunting for malicious cyber activity. Argo Cyber provides support for on- and offsite incident response to government agencies and critical infrastructure owners who experience cyber-attacks. Argo Cyber delivers HIRT advanced technical assistance, proactive hunting, rapid onsite incident response, and immediate investigation using host- and network-based cybersecurity analysis capabilities. Personnel perform investigations to characterize the severity of breaches and develop mitigation/remediation plans.

Argo Cyber is seeking a Subject Matter Expert with deep expertise in one or more edge device technologies (Cisco, Ivanti, Palo Alto, Ciena, Juniper) to support this critical customer mission.

Responsibilities

• Serves as a hunt and incident response subject matter expert (SME), applying in-depth knowledge of threat actor tools, techniques, and procedures (TTPs), with a focus on network centric and edge device compromises.
• Serves as an incident response expert in support of a technology insertion team, evaluating and integrating new network forensic and monitoring capabilities.
• Assists the Government lead in coordinating teams for preliminary incident response investigations, including onsite and remote engagements.
• Assists the Government lead by interfacing with the customer while onsite, clearly communicating status, findings, and recommendations.
• Characterizes and analyzes network traffic (including PCAP, flow, and device logs) to identify anomalous activity and potential threats to network resources.
• Identifies and analyzes anomalies in network traffic using metadata (e.g., flow records, DNS logs, proxy logs) to detect and scope malicious activity.
• Reconstructs malicious attacks or activities based on network traffic, including timelines, attacker paths, and data exfiltration patterns.
• Examines network topologies to understand data flows, trust boundaries, and potential choke points; uses this understanding to inform hunt and response activities.
• Assesses network topology and device configurations, identifying critical security concerns and providing security best practice recommendations, especially for Cisco, Ivanti, Palo Alto, Ciena, and Juniper platforms.
• Determines appropriate courses of action in response to identified and analyzed anomalous network activity, including containment, eradication, and hardening actions.
• Applies knowledge of defense-in-depth principles and general attack stages to evaluate and improve network security architecture and edge-device configurations.
• Applies knowledge of network device integrity concepts and methodologies to validate device state, detect unauthorized modification, and recommend remediation.
• Leads analysis of device logs, configurations, and telemetry from routers, switches, firewalls, VPNs, and remote access appliances to identify, scope, and reconstruct intrusions.
• Provides expert support, analysis, and research with only broad direction into exceptionally complex problems and processes relating to hunt and incident response activities.
• Serves as a technical expert on high-level incident response teams, providing technical direction, interpretation, and alternatives for network-centric incidents.
• Exercises considerable latitude in determining technical objectives and independently develops technical solutions to complex problems requiring ingenuity and creativity.
• Analyzes incident data and victim environments to recommend targeted mitigations, including network segmentation, policy updates, and device hardening.
• Advises technical personnel on countermeasure implementation and customization (e.g., firewall rules, IPS signatures, access control lists).
• Supports internal stakeholders on containment and eradication missions, on-site and remotely.
• Ensures evidence integrity is preserved according to standard operating procedures or national standards when collecting network data, device artifacts, and logs.
• Assists with the writing and publishing of Computer Network Defense (CND) guidance and detailed reports on incident findings to appropriate constituencies.
• Distills analytic findings into executive summaries and in-depth technical reports suitable for both leadership and highly technical audiences.
• Documents analysis, TTPs, and device specific incident handling procedures in a standardized knowledge base for sharing and publication.
• Assists in maintaining branch process and procedure documentation and guides the completion of hunt and incident response activities.

Required Skills

• U.S. Citizenship.
• Active TS/SCI clearance.
• Ability to obtain DHS Suitability.
• 10+ years of directly relevant experience
• 3+ years of experience related to the evaluation and implementation of new cyber response or network forensic capabilities.
• Hands-on experience with incident response or network operations involving enterprise edge devices from at least two of the following vendors: Cisco, Ivanti, Palo Alto, Ciena, Juniper.
• Strong understanding of network architecture and security, including routing, switching, VPNs, firewalls, segmentation, and defense in depth.
• Knowledge of Computer Network Defense (CND) policies, procedures, and regulations relevant to U.S. government or similar environments.
• Ability to: o Characterize and analyze network traffic to identify anomalous activity and potential threats. o Identify and analyze anomalies in network traffic using metadata (flow, DNS, proxy, etc.). o Reconstruct malicious activity based on network traffic and device logs.
• Understanding of general attack stages (reconnaissance, initial access, lateral movement, exfiltration, etc.) and how they manifest across the network.
• Understanding of system and application security threats and vulnerabilities and how they are observed in network traffic.
• Understanding of proactive analysis of systems and networks, including establishing trust levels of critical resources and detecting anomalous behavior.
• Proficiency with common operating systems (e.g., Linux/Unix, Windows).
• Experience performing cyber incident response (scoping, containment, eradication, recovery) in operational environments.
• Ability to think independently, make sound decisions under pressure, and work with limited guidance.
• Superior written and oral communication skills, including the ability to clearly explain technical issues to both technical and non-technical stakeholders.
• Ability to work collaboratively across physical locations and within distributed teams.
• Skilled in identifying different classes of attacks and attack stages and translating findings into actionable recommendations.
• Rapid Network & Tapping Setup: Ability to quickly configure network TAPs, packet brokers, SPAN ports, and unmanaged/managed switches without disrupting live production or air-gapped traffic.

Desired Skills

• Experience leading and mentoring technical teams in incident response, network operations, or security engineering.
• Network and system administration experience in large or complex enterprise or service-provider environments.
• Strong understanding of adversarial TTPs (including MITRE ATT&CK) and different operational threat environments (e.g., script kiddies, non nation state adversaries, nation state actors).
• Knowledge of defense-in-depth and zero trust principles and their application to network and edge-device architectures.
• Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, injections, race conditions, covert channels, replay, ROP, malicious code).
• Knowledge of network device integrity verification and monitoring approaches.
• Hands-on skill in host/network intrusion detection and event correlation across multiple telemetry sources (firewalls, IDS/IPS, endpoint, SIEM).
• Experience with malicious activity analysis, including network beaconing, C2, and data exfiltration detection.
• Experience with Identity and Access Management (IAM) tools and their integration into network/edge security architectures.
• Ability to review and analyze Enterprise Architecture (EA) from a security perspective and recommend architecture-level improvements.
• Ability to collaborate with stakeholders at multiple levels within an organization (technical staff, management, senior leadership).
• Field Diagnostics & Cyber Forensics: Skills in running preloaded analysis stacks, protocol parsers (e.g., Modbus, DNP3, OPC UA), vulnerability scanning, and local packet capture at line rate.
• Compact Pack & Weight Management: Packing, securing, and transporting ruggedized cases (such as Pelican or Nanuk) that fit standard weight and carry-on/air-transport limits.

Required Education

• BS in Computer Science, Cyber Security, Computer Engineering, or related degree; OR HS Diploma/GED and 22+ years of technical experience in the area of expertise.

Desired Certifications (One or more)

• IASAE II, CSSP Analyst, GCIA, GCIH, CSSP Incident Responder,CEH,
• SANS GIAC GCIA or GNFA (preferred for network forensics).
• SANS GRID, GICSP, or GCIP (plus).
• Vendor / network certifications (highly desired): o Cisco CCNA (or higher: CCNP Security, CCNP Enterprise). o Vendor certifications for Palo Alto, Juniper, Ciena, or Ivanti (e.g., PCNSE, JNCIS/JNCIP, etc.).

Apply Today

If you are an experienced cybersecurity professional with a passion for artificial intelligence, emerging technologies, and national cybersecurity defense, we encourage you to explore this opportunity with Argo Cyber Systems.

Position: AI Security Subject Matter Expert (SME) Company: Argo Cyber Systems, LLC Clearance: Active TS/SCI Required

Argo Cyber Systems is an Equal Opportunity Employer. Employment decisions are made without regard to legally protected characteristics, consistent with applicable federal, state, and local laws.

Background & Drug Screening Disclaimer

© Argo Cyber Systems, LLC - All Rights Reserved

Argo Cyber Systems, LLC is committed to maintaining a safe, secure, and trusted workplace for all employees and our federal clients. Employment with Argo Cyber Systems is contingent upon successful completion of all required background investigations and pre-employment screenings, which may include, but are not limited to:

• Criminal background checks (federal, state, and local)

• Employment and education verification

• Reference checks

• Drug screening (in compliance with federal and state law)

• Security clearance verification (as applicable for classified positions)

Candidates selected for employment in positions requiring access to sensitive or classified information may also be subject to additional U.S. Government background investigations and security adjudication processes, including DHS Entry on Duty (EOD) suitability or equivalent federal clearance requirements.

Argo Cyber Systems reserves the right to disqualify or rescind an offer of employment based on the results of any background or screening process that, in the company's judgment, may impact an individual's ability to perform essential job functions or meet contractual obligations.

All background investigations and screenings are conducted in accordance with applicable federal, state, and local laws, including the Fair Credit Reporting Act (FCRA). Candidates will be notified of their rights and provided an opportunity to review and dispute any adverse findings before final employment determinations are made.