Coalfire

• Lead and support advisory engagements across the Public Sector frameworks • Maintain strong client relationships throughout the engagement lifecycle • Provide oversight across compliance frameworks such as FedRAMP, CMMC, DISA Cloud SRG, FISMA, etc. • Review and develop compliance documentation • Ensure quality through peer reviews • Collaborate with internal stakeholders • Support IT security consulting for cloud and on-premises environments • Directly manage and mentor 2-3 team members • Foster client relationships and lead various engagements within the Public sector advisory team • Build a culture of accountability and excellence while nurturing high-trust partnerships with clients and stakeholders • Provide advisory consulting support and develop compliance-related reports and documentation • Ensure quality control through peer reviews of project deliverables • Partner with sales, quality management, and delivery teams to ensure project timelines and deliverables are met • Mentor team members in technology, consulting methodologies, technical reviews, and professional writing

• Lead red team, adversary emulation, and purple team engagements for clients across a range of industries and environments, recommending appropriate remediation measures, with reporting aligned to MITRE ATT&CK and other relevant frameworks. • Detection and response evasion, creation of novel tactics and exploits, simulation of threat actor TTPs, and the evolution of sophisticated command and control (C2) infrastructure. • Act as a trusted advisor to our clients on security matters, providing insights and recommendations to inform strategic decision-making. • Develop and execute on sophisticated offensive cybersecurity tradecraft to gain initial access, establish persistence, escalate privileges, move laterally, and evade detection and response controls. • Stay current with emerging security threats and trends, and proactively identify areas of improvement to enhance our security posture. • Develop and maintain custom exploit code, scripts, and tools to automate and streamline adversary services activities. • Contribute to internal tradecraft, reusable tooling, testing methodologies, and team knowledge sharing. • Support thought leadership through research, internal training, blog content, conference presentations, or customer workshops.

• Develop and drive business development initiatives that align with our current and future cybersecurity portfolio service offerings • Responsible for creating and executing a quarterly business development plan and process, including coordination of all necessary internal and external resources to identify and secure business opportunities • Prepare quarterly review on business prospects and market conditions to ensure revenue and resources are aligned with business goals • Build working relationships cross-functionally with project management team, delivery team, and marketing to ensure coordination of efforts and good communication with all parties • Establish a repeatable process for deal review, approval, and deal execution • Support building market awareness internally and externally for our Cybersecurity portfolio service offerings • Make an impact to Account Management, including account planning, client procurement, meeting follow-up, pipeline development, opportunity pursuit, contract negotiation, risk management, proposal and Statement of Work (SOW) development, and revenue goals • Engage with clients in strategic discussions to provide best in class Cybersecurity / IT Strategy and industry guidance to maximize client’s long-term business objectives. • Develop strong and lasting relationships with client executives, effectively engage new business and position the account for follow on security and risk advisory engagements. • Develop and maintain contact with top decision makers at key clients; organize and lead pursuit teams; participate and lead aspects of the proposal development process; contribute to the development of proposal pricing strategies. • Lead client-facing management Security Strategy and Planning sessions and formal proposal presentations. • Maintain customer strategy and direction while collaborating with internal teams, leveraging sales tools such as Salesforce. • Contribute to problem-solving sessions with the project team, consulting team, and client representatives on a regular basis. • Develop business with new buyers and business units within existing accounts. • Marketing Qualified Lead management from origination of lead through lead qualification to lead conversion to new opportunity

Role Description This is a great opportunity to grow your career and lead enterprise engagements as a Senior Consultant! In this position you will assess the security and compliance of client firms against regulatory and industry requirements and standards, and against security best practice frameworks. You will have a strong understanding of framework requirements, perform audit/assessments, and develop reports for clients. You will also provide quality control and peer review to other members of the delivery staff. This role works closely with Project Managers, Directors and other Delivery team members to effectively manage project timelines and deliverables. As a Senior Consultant, you will regularly interact with peers and clients as both an auditor and assessor, depending on the engagement. This role will audit information systems with confidence and accuracy to ensure the integrity and effectiveness of security measures. You will test technical controls, policies and procedures, laws, regulations, and industry best practices. What You'll Do - Lead audits/assessments full cycle including audit plan preparation, review of documentation and evidence, evaluation of procedures, and client interviews. - Prepare, review and approve assessment reports. - Manage priorities, tasks and hours on projects in conjunction with the project manager to achieve delivery utilization targets. - Manage quality throughout the entirety of the engagement, while providing direct coaching and revisions to work products. - Ensure quality products and services are delivered on time. - Escalate client and project issues to management in a timely manner to inform and engage the necessary resources to address the issue. - Provide mentorship to team members in areas of audit, assessment, technical review and writing. - Interface with clients through entire engagement, interacting will all levels of client organizations. Establish and maintain positive collaborative relationships with clients and stakeholders. - Continuous professional development in maintaining industry specific certifications. Maintains strong depth of knowledge in the practice area. - Collaborate with project managers, quality management, sales and other delivery team members to drive customer satisfaction and meet project deliverables. - Establish account relationships and identifies upsell and cross sell opportunities and escalates to sales. - Travel 25-50%. - Ability to be successful when working remotely. Qualifications - Current PCI-QSA certification preferred (will consider former QSA). - One of the following Information Security certifications required: CISSP, CISM or ISO 27001 Lead Implementer. - One of the following Audit certifications required: CISA, GSNA, CIA, IRCA ISMS Auditor or higher, or ISO 27001 Lead Auditor. - Familiarity with other common IT Audit frameworks (SOC 2, ISO 27001, FedRAMP, HITRUST, etc.). - Bachelor's degree (four-year college or university) or equivalent combination of education and work experience. - Strong knowledge of the PCI-DSS security standards. - 5+ years of experience in an IT Security Audit and/or Compliance role. - Experience preparing and presenting Tier 1 and Tier 2 Reports on Compliance (ROCs). - Experience performing IT security risk assessments and gap analysis. - Strong excel skills with ability to develop worksheets with complex formulas. - Experience interacting with management in a consultative manner. - Strong IT understanding with respect to networks, servers, workstations, and applications. - Excellent communication and presentation skills. Ability to facilitate meetings of small or large groups. - Strong written and verbal communication skills including the ability to explain technical matters to a non-technical audience. - Strong Consulting skills with executive leadership and technical professionals; ability to advise and challenge the status quo while building strong relationships. - Positive attitude. - Diplomatic and broad minded. - Ability to build high-trust relationship and credibility quickly both internally and externally. - Strong attention to detail, strong problem solving, decision-making, organizational and analytical skills. - Ability to prioritize and manage multiple initiatives/projects. - Ability to be self-driven and have strong independent initiative. Benefits - Flexible work model that empowers you to choose when and where you’ll work most effectively. - Opportunities to join employee resource groups, participate in in-person and virtual events. - Competitive perks and benefits to support you and your family, like paid parental leave, flexible time off, certification and training reimbursement, digital mental health and wellbeing support membership, and comprehensive insurance options. Salary $86,000 - $148,000 a year. The salary range listed is a reasonable estimate of the compensation range for this role based on national salary averages. The actual salary offer to the successful candidate will be based on job-related education, geographic location, training, licensure and certifications and other factors. You may also be eligible to participate in annual incentive, commission, and/or recognition programs.

• Own the MQL to opportunity handoff process — ensuring leads are routed correctly, followed up on promptly, and that no lead goes unactioned. • Partner with marketing to define and maintain lead quality standards, MQL definitions, and conversion benchmarks; hold both sides accountable to agreed service levels. • Monitor pipeline generation against targets on a weekly basis; identify gaps and hold teams accountable to commitments. • Serve as the primary point of escalation when pipeline generation is at risk — proactively surfacing issues to Sales Leadership before they become forecast problems. • Partner with the Director, Forecasting & Revenue Analytics to ensure top-of-funnel metrics connect to pipeline and bookings forecasts. • Coordinate across marketing, offering management, and delivery to ensure the field has the tools and content needed to execute — including pricing, bid sheets, scoping tables, proposal templates, and value messaging. • Own the relationship with Coalfire’s outsourced SDR vendor — including performance management, target setting, activity alignment, and contract oversight. • Own and maintain Coalfire’s master GTM calendar — coordinating activity across marketing campaigns, events, offering launches, partner programs, SDR plays, AE activity, and training. • Travel as required by leadership — generally less than 20%

• Support the lifecycle management of cybersecurity and compliance offerings, including ideation, design, refresh, packaging, launch, enablement, sustainment, and retirement activities. • Partner with offering leadership, practice leaders, and solution stakeholders to standardize services into repeatable components, tiers, variations, and SKU-ready structures that improve scalability and consistency. • Own day-to-day coordination of offering initiatives, including intake tracking, status reporting, meeting preparation, follow-up actions, and documentation of decisions across offering governance forums and portfolio workstreams. • Create and maintain go-to-market sales collateral, including proposal materials, datasheets, whitepapers, standard presentations, catalogs, and other enablement content that clearly articulates Coalfire's value to clients and the field. • Perform competitive analysis and pricing support for Coalfire offerings to inform packaging, list pricing, margin targets, and growth strategies for enterprise-level clients. • Support pre-sales activities, including client meetings, solutioning discussions, and cross-functional RFP responses, ensuring offerings are positioned clearly and scoped consistently. • Stay current with emerging security threats, industry trends, and client demand patterns, and proactively recommend updates to offerings, messaging, and portfolio priorities. • Partner with senior leadership and cross-functional teams to improve scoping, quoting, and contracting workflows, including cost case optimization, standard scope definitions, and SOW content inputs. • Support the development of new threat-focused services, including initial research, offering design, pricing inputs, staffing assumptions, collateral development, partner coordination, and internal enablement.

• Assess the security posture and maturity of OT environments for clients across manufacturing, energy, utilities, and other critical infrastructure sectors • Conduct stakeholder interviews, review OT documentation, evaluate security practices against industry frameworks, and develop maturity assessment reports with remediation recommendations • Present findings and strategic guidance to clients while working with Project Managers, Directors, and Delivery teams to manage project scope and timelines

• Conduct hands-on compliance audits and testing of digital platforms for adherence to global regulations such as GDPR, CCPA, COPPA, DSA, DMA, UK OSA, and SC AADC • Design and execute independent audit methodologies and testing protocols to assess user protection mechanisms, content moderation systems, and data handling practices • Test privacy-by-design mechanisms, such as data collection, processing, retention, and deletion mechanisms to verify compliance with user consent and data minimization requirements • Audit child safety protections and age verification mechanisms for COPPA compliance and child exploitation prevention measures • Test content moderation systems and harmful content detection capabilities for effectiveness and fairness across user communities • Audit algorithmic decision-making systems for discriminatory outcomes and test transparency and explainability in automated systems • Present assessment findings, risk analysis, and strategic recommendations to clients and their leadership through executive briefings and detailed reports • Support other security and privacy consulting engagements when necessary to maintain team capacity

• Own and manage Coalfire’s social media content calendar and publishing cadence across corporate priority channels. • Create original content across formats, including social posts, campaign copy, short videos, motion snippets, executive content, event recaps, customer story highlights, webinar promos, and other digital brand assets. • Write compelling, audience-first copy that turns complex cybersecurity, compliance, and AI topics into clear, engaging stories for executive and practitioner audiences. • Capture and shape content ideas into strong narratives, hooks, and story arcs that help Coalfire stand out in-market and make technical subject matter more accessible and memorable. • Edit video content for social and campaign use, including clipping webinars, interviews, event footage, demos, and thought leadership moments into polished, channel-ready assets. • Develop or adapt visual assets such as social graphics, quote cards, carousels, simple motion graphics, thumbnails, and branded promotional materials in partnership with design or through light hands-on production. • Partner with marketing leaders, designers, campaign owners, executives, and subject matter experts to develop channel-ready content and creative assets aligned to launches, campaigns, events, webinars, case studies, and research. • Repurpose long-form content into high-performing multi-channel assets, extending the value of reports, blogs, webinars, presentations, podcasts, video, and event content. • Manage day-to-day publishing, scheduling, and platform operations using social management tools such as Sprout Social or similar workflows already in use at Coalfire. • Support and help scale Coalfire’s employee advocacy efforts by activating internal voices, shaping suggested messaging, and encouraging broader participation across the business. • Monitor channel and content performance and produce clear, actionable reporting on engagement, audience growth, content performance, and social impact on website traffic, form fills, qualified leads, and broader business outcomes. • Manage and engage in Coalfire’s internal social workflows, including coordination in the social Slack channel and collaboration with cross-functional stakeholders. • Stay current on platform changes, content trends, storytelling formats, and creative best practices, then translate those insights into smarter recommendations for Coalfire’s brand and audience strategy. • Protect brand integrity by ensuring all external communications align with Coalfire brand guidelines, social media guidance, and confidentiality expectations.

• Working independently and collaboratively with a team to both lead and support • Perform penetration testing on applications with complex technology stacks from both a blackbox and whitebox perspective. • Dynamically flex your skills when assessing emerging or custom technologies. • Contextualize vulnerabilities and assess realistic impact to a client accounting for mitigating and aggravating factors. • Manage priorities and tasks to achieve utilization targets. • Operate with professionalism both internally and with clients. • Ensure quality reports and services are delivered efficiently and on time. • Maintains strong depth of knowledge in the practice area. • Collaborate with project managers, quality management, sales and other delivery team members to drive customer satisfaction and meet project deliverables.