Top Tech Jobs & Startup Jobs in San Francisco Bay Area, CA

The Scrum Master facilitates Agile ceremonies, coaches Scrum teams, removes impediments, manages dependencies, supports backlog prioritization, monitors sprint progress, and promotes continuous improvement. The role collaborates with Product Owners, government stakeholders, and technical teams while ensuring contract compliance and clear communication of project risks and status. It supports complex federal IT projects in a fully remote environment and requires Scrum expertise, government contracting experience, strong facilitation, and familiarity with Agile tools.

Supports authorized red team and penetration testing engagements across networks, applications, APIs, systems, and cloud environments. Performs reconnaissance, vulnerability validation, exploitation, attack-path analysis, and security control testing under established rules of engagement. Documents vulnerabilities, evidence, adversary techniques, risks, and remediation recommendations using MITRE ATT&CK, retests fixes, and monitors emerging exploits and defensive technologies.

Conduct authorized red team and penetration testing assessments across enterprise networks, applications, APIs, identity systems, and cloud environments. Develop realistic MITRE ATT&CK-aligned attack scenarios, perform reconnaissance through exploitation and lateral movement, identify attack paths, evaluate defensive detection, and document findings with remediation recommendations. Participate in purple team exercises, validate remediation, develop testing scripts and tools, and mentor less-experienced testers. The role requires a Public Trust clearance, U.S. citizenship, relevant certifications, and at least five years of experience.

Performs and leads penetration tests and vulnerability assessments of customer information systems. Identifies exploitable vulnerabilities, conducts root cause analysis, recommends remediations aligned with NIST SP 800-53, and presents findings to system owners and engineers. Maintains Red Cell infrastructure, develops or modifies testing tools, applies computer and network forensics, researches emerging vulnerabilities and countermeasures, and contributes to methodologies, deliverables, and performance metrics.

Provides senior cybersecurity incident response, breach management, compliance assessment, and risk management support for higher education institutions handling sensitive federal data. Coordinates incident investigation, containment, remediation, corrective actions, and case closure; evaluates administrative, technical, and physical safeguards; identifies compliance gaps; develops reports and actionable recommendations; and advises government, institutional, and technical stakeholders on protecting CUI, FTI, and PII.

Conduct independent full-scope federal IT audits, internal control reviews, FISMA self-assessments, and IV&V of audit corrective actions. Evaluate control effectiveness, maintain internal control inventories, assess risk mitigation activities, analyze findings, apply data analytics and automated testing, and present recommendations to customer management. The role requires knowledge of federal audit frameworks, OMB A-123, NIST assessment guidance, COBIT, COSO, GAO FISCAM, and experience supporting OIG and GAO audits.

Leads IT business process analysis, improvement, and automation for a federal risk management and administration office. Designs and maintains SharePoint and Microsoft Power Platform solutions, including Power Apps, Power Automate, and Power BI dashboards. Supports risk, audit, policy, compliance, and records management activities; prepares status reports, meeting minutes, and written communications. Applies Agile and Waterfall methods, evaluates AI productivity tools, and coordinates cross-functional automation initiatives.

Conduct full-scope IT audits and control reviews for a federal customer; assess compliance with federal frameworks, coordinate OIG and GAO audit requests, manage stakeholder communications, track corrective actions, prepare closure packages, maintain audit documentation and dashboards, reconcile audit statistics, and support control testing and internal controls inventory updates.

Develop and govern federal IT policies, directives, SOPs, and guidance for a CIO organization. The role manages a 40-plus-document policy inventory, coordinates reviews and updates, identifies policy gaps, ensures alignment with federal statutes and NIST standards, translates technical and cyber risk into strategic recommendations, and briefs executives. The planner also manages policy lifecycles, stakeholder collaboration, document dependencies, and five-year review requirements.

Provides security engineering and compliance expertise for FedRAMP Cloud Service Provider authorization packages. Reviews cloud architectures, security controls, system security plans, assessment reports, vulnerability scans, and penetration tests against NIST, FedRAMP, FISMA, RMF, and agency requirements. Leads architecture interviews, identifies technical and documentation gaps, advises government program leaders and CISOs on risk posture, supports continuous monitoring, and guides vendors through remediation and authorization activities.