K2United

Engineer

• Implement, operate, and maintain Continuous Diagnostics and Mitigation (CDM) capabilities that strengthen enterprise cybersecurity posture
• Maintain the CDM scanning infrastructure supporting client systems across on-premises, cloud, and hybrid environments
• Partner with technical stakeholders to expand and mature CDM capabilities as the environment evolves through modernization and cloud adoption
• Support the transition to Ongoing Authorization by providing continuous monitoring and security visibility
• Deliver continuous asset visibility and improve detection of vulnerabilities, configuration issues, unmanaged assets, and unauthorized software or hardware
• Manage enterprise vulnerability scanning infrastructure, including credentialed scanning across systems, devices, and applications
• Analyze vulnerability scan results, prioritize risk, and provide actionable remediation recommendations
• Monitor the CISA Known Exploited Vulnerabilities (KEV) Catalog and other authoritative guidance to support timely remediation and compliance with applicable Binding Operational Directives
• Support enterprise asset inventory, configuration monitoring, and compliance reporting activities
• Collaborate with the client and department stakeholders, system owners, administrators, and technical teams to improve security operations, optimize tools, and support incident response activities
• Contribute data and analysis supporting executive cybersecurity reporting, including weekly CIO dashboards and ad hoc vulnerability reports
• Produce and maintain required CDM deliverables, including CDM Scan Results on the DHS-defined periodicity of no less than every three days, CDM Mitigation Procedures documenting mitigation steps and end-user mitigation activities when requested, and compliance reporting

Mid-Level Continuous Diagnostics and Mitigation Engineer

• Manage, operate, and maintain vulnerability-management infrastructure capable of performing credentialed scans across approved client-managed systems, devices, and applications.
• Perform host-based, network-based, application, and database vulnerability scanning and deliver actionable remediation guidance.
• Analyze scan results and network architecture to identify the highest-risk vulnerabilities and recommend appropriate mitigation steps.
• Conduct specialized assessments for High Value Assets (HVAs) and other designated systems, ensuring reports meet HVA requirements.
• Support the implementation, operation, and maintenance of vulnerability-management projects within client's Information Security Project Dashboard.
• Alert technical points of contact to risks posed by vulnerabilities, missing assets, configuration errors, and unauthorized software or hardware.
• Escalate critical vulnerabilities within 24 hours and track remediation to closure in accordance with applicable federal, department, and agency policy and contractual remediation timelines.
• Monitor the CISA Known Exploited Vulnerabilities (KEV) Catalog and other authoritative sources to support timely remediation and compliance with applicable Binding Operational Directives.
• Coordinate with program areas and system owners to prioritize mitigation steps, including end-user mitigation activities when needed.
• Provide risk analysis for identified vulnerabilities and system change requests.
• Drive findings to verified closure through ticketed workflows, coordinating with the separate technical teams that perform system patching, and validate remediation through authenticated re-scans with recorded evidence.
• Maintain regular communication with client and department stakeholders to support collaboration, process improvement, tool tuning, information sharing, and compromise response.
• Monitor government and private-sector vulnerability sources to identify emerging risks that may affect client-managed systems.
• Contribute to vulnerability management reporting and ad hoc compliance deliverables supporting department, DHS, and FISMA requirements.

Mid-Level Vulnerability Management Engineer

Data Analyst

• Operate DLP tools and associated processes to automatically protect sensitive client information across data in use, in transit, and at rest.
• Define, discover, and protect sensitive information regardless of where or how it is stored or used.
• Prevent exfiltration through network gateways and endpoints while supporting visibility into encrypted traffic.
• Provide automated policy enforcement to safeguard sensitive data and support privacy requirements.
• Support and validate discovery of sensitive information within repositories such as SharePoint, network drives, and databases using data-at-rest DLP capabilities.
• Implement technical measures that help protect sensitive information from inadvertent disclosure and exfiltration on endpoints, across the network, and within storage environments.
• Support the deployment of DLP agents on targeted endpoints that routinely handle sensitive data.
• Track endpoint DLP agent deployment for targeted devices and support enterprise reporting needs.
• Analyze DLP alerts and events, distinguish true policy violations from false positives, tune detection rules to reduce noise, and escalate confirmed incidents to the incident response team with complete context.
• Contribute to DLP policy enforcement documentation, sensitive-data discovery validation results, and ad hoc information security reporting.

Mid-Level Data Protection, DLP Analyst

Analyst

• Execute ongoing-authorization control evaluations on a rotating quarterly cycle, documenting results, dispositioning each control as satisfied or other-than-satisfied, and injecting findings into the POA&M process.
• Develop and maintain system-level Continuous Monitoring (ConMon) Plans providing ongoing visibility into each system’s security posture.
• Populate and continuously maintain the enterprise Risk Management Register, logging all identified system-level risks with severity, status, and mitigation plans, and preparing the monthly register deliverable.
• Manage and track POA&Ms to timely remediation, enforcing linkage of every weakness to a control, aging findings against remediation clocks, and maintaining milestones, owners, and evidence.
• Support the risk mitigation waiver lifecycle, including standardized intake, documented risk determination and approval authority, maintenance of the Risk Mitigation Waiver Register, annual reassessment of active waivers, escalation of expirations, and recommendations to terminate, modify, or renew based on current risk posture.
• Coordinate and document annual Contingency Plan and Incident Response Plan tests, including test reports with results, lessons learned, and corrective actions.
• Verify artifact freshness across the authorization portfolio and flag stale evidence for refresh before it becomes an audit finding.
• Provide enhanced oversight for High Value Assets, including prioritized monitoring and reporting.
• Prepare continuous monitoring inputs for weekly executive dashboards, the monthly cybersecurity risk profile, and quarterly and annual FISMA reporting.
• Support internal and external assessments and audits, including artifact collection, interview support, and corrective-action tracking for OIG, GAO, and departmental reviews.

Mid-Level RMF Controls, ConMon Analyst

Security Engineer

• Serve as a trusted security advisor to system owners, business owners, and technical teams
• Guide systems through the Risk Management Framework (RMF) and support their Authority to Operate (ATO)
• Develop and maintain authorization documentation, continuous monitoring strategies, contingency planning, and security guidance
• Ensure client systems remain compliant with federal cybersecurity requirements
• Support authorization package development while maintaining appropriate independence from formal Security Control Assessment (SCA) and Final Assessment Report (SAR) validation activities
• Create foundational system documentation, including Boundary Scope Memorandums (BSM), System Architecture diagrams, and Authorization Boundary and Network Diagrams (ABND)
• Validate technical evidence, including configuration artifacts, scan reports, and system documentation, to ensure compliance
• Develop and maintain system-level Contingency Plans (CP), Incident Response Plans (IRP), and Continuous Monitoring (ConMon) Plans
• Facilitate RMF training sessions, office hours, and user guidance

Mid-Level Information System Security Officer – System Owner Support

Content Marketing Manager

• Develop multi-channel content plans and campaign messaging that translate marketing leadership direction into executable content strategies, timelines, and deliverables.
• Write and refine marketing emails, value proposition collateral, classroom implementation collateral, blogs, social media copy, webinar content, conference presentations, campaign messaging, and sales enablement assets.
• Create content that supports clear, coordinated market conversations across priority audiences and ecosystems, including CTE, workforce development, small business, and government cybersecurity.
• Improve marketing content discoverability through SEO-, AEO-, and GEO-informed recommendations, updates, topic alignment, and optimization workflows.
• Evaluate and apply emerging AI-enabled content, search, and optimization practices that support marketing performance and audience engagement.
• Author sales and business development enablement content that connects customer pain points, use cases, outcomes, differentiators, and proof points.
• Refresh and repurpose existing content across formats, audiences, channels, and use cases so high-value assets remain current, useful, and easier to reuse.
• Coordinate content review and delivery workflows so assets move from brief to approved or delivery-ready state with clear ownership, timely input, accuracy, and brand alignment.
• Partner with Marketing Leadership, Sales, Business Development, Graphic Design, Product Design, Conference stakeholders, and presenters to keep content aligned and moving.

Senior Marketing Content Specialist

Data Engineer

• The Senior Data Engineer will own the data engineering function on K2Share's Federal Team, partnering with technical and product leadership to deliver data products that support mission-critical decision-making for federal agency clients.
• Design and build relational data layers that handle OSCAL and other structured compliance data - including ingestion, validation, transformation, and export workflows that preserve fidelity to source schemas across the full data lifecycle
• Design and maintain data models that support governance, risk, compliance, scoring, and reporting workflows for federal cybersecurity programs, with OSCAL as the connective layer across them - including long-term retention and archival policies that align with federal recordkeeping and audit requirements
• Design and build big-data processing pipelines on Databricks (PySpark, Delta Lake, Unity Catalog) that normalize cybersecurity data from across federal agency environments and produce analytical layers for trend analysis, executive reporting, and cross-program insights
• Optimize data systems for performance and cost - identifying I/O and compute bottlenecks, scaling compute responsibly, and balancing throughput against the cost discipline federal engagements require
• Architect, build and maintain AWS data infrastructure that meets federal security and operational requirements - working across services such as S3, Bedrock, Lambda, Fargate, and EC2 in support of compliance and analytical workloads
• Design and implement audit-ready data primitives - change capture, access controls, validation, and lineage — that support agency reporting and continuous monitoring needs
• Lead AI-first development and responsible AI deployment on the data team - using AI development tools as a standard part of the engineering loop, prototyping AI-assisted compliance workflows, and designing the production AI systems behind them (RAG architectures, vector store management, conversational agents, prompt and output guardrails, and evaluation pipelines), in alignment with federal AI governance guidance (OMB, NIST AI RMF)
• Engage with federal agency stakeholders and internal teams during requirement discovery, delivery, and ongoing support — translating compliance needs into data products and customer feedback into improvements