What is at stake
A checklist is not a decision.
A headquarters introduces new cloud services, new vendors, and new applications every week. Each one needs a decision: where the data lives, who can reach it, how a third party interacts with it, and whether the risk fits the mission. The decision has to be right, and it has to be fast, or the mission routes around security.
Meanwhile tens of thousands of endpoints, some at sea or at remote sites on thin links, have to stay patched and reporting. When something does go wrong, the detection has to fire, the response has to be coordinated with the people who own the infrastructure, and the record has to be complete. Under federal records law, that record is a legal record as well as a technical one.
What we do
From the first review to the last audit record.
Assess risk and authorize
Pre-acquisition security reviews of new services and vendors, risk-based ATO evaluations against the agency's own standards, eMASS, POA&Ms, continuous monitoring, and reauthorization at every classification level.Secure the cloud and the code
FedRAMP and non-FedRAMP vendor risk, bring-your-own-key encryption and key management, identity federation and conditional access, secure code policy, and static and dynamic application testing in the CI/CD pipeline.Keep endpoints compliant
Enterprise patch and endpoint security for tens of thousands of assets, including low-bandwidth remote sites, with automated continuous monitoring, mobile device management, and endpoint detection and response.Engineer detection
SIEM architecture and tuning on Splunk, Elastic, and Microsoft Sentinel. Correlation rules aligned to the environment's threats, SOAR automation, and alerts that open tickets without a human relay.Respond and investigate
24x7 security operations center support, NIST 800-61 aligned incident response, hunt operations, malware analysis, and digital forensics with chain of custody.Implement zero trust
Identity, endpoint, and network telemetry integrated into a zero trust architecture, from pilot design with research partners to full operational deployment.How we do it
Security enters at design review, not at delivery.
Findings in operational context
We evaluate identity, access, system interactions, and data handling as the system is actually used. Each finding names the system, the risk to the mission, and the fix.Fewer false positives, coverage reviewed on a schedule
Correlation rules follow the environment's threat vectors and are refined against observed activity. Detection coverage is reviewed against current techniques on a schedule.From alert to ticket without a human relay
SIEM events open security tickets automatically, so containment and resolution start from a record, not a phone call.Authorizations kept current
Continuous monitoring and scheduled reauthorization, the practice the market calls continuous authorization, with artifacts maintained as the system changes rather than rebuilt at the deadline. Security considerations enter the engineering lifecycle early, so there is no costly rework.Technologies we work in
The tools our people run today.
Listed by product so an evaluator can match us to a requirement and a candidate can find a role. Tools are named; the environments they run in are not.
Detection and response
- Microsoft Sentinel
- Elastic
- Splunk
- LogRhythm
- Microsoft Defender for Endpoint
- Swimlane SOAR
- Security Onion
- Snort
Endpoint and vulnerability
- Tanium
- Forescout
- Nessus and ACAS
- Trellix (HBSS/ESS)
- Proofpoint
- Cisco Firepower
- F5 BIG-IP
Zero trust and identity
- DISA Thunderdome
- Palo Alto NGFW
- Gigamon
- Microsoft Entra ID
- ADFS
- PKI
- Cisco ISE and 802.1x
Application security
- Fortify SAST
- WebInspect DAST
- GitHub code scanning
- OWASP ASVS
- API governance
- Jira and Confluence
Authorization and compliance
- eMASS
- RMF and NIST SP 800-53
- JSIG
- FedRAMP
- POA&M management
- DISA STIGs
- Power BI compliance dashboards
Forensics and analysis
- EnCase
- FTK
- Volatility
- Wireshark
- IDA Pro
- Azure OpenAI and Copilot for security analytics
In practice
Where this has already been done.
Described without identifying the customer, as our release policy requires. Prime or subcontractor role is stated.
References for this work go to contracting officers and teaming partners on request. Request past performance
Careers
The people who do this work.
Security assessors and ISSOs, SIEM engineers, endpoint engineers, incident responders, and forensic analysts.