Information Architect

Everforth ECS is seeking a Information Architect / Records Management Business Analyst (TS) to join our team in Arlington, VA (Hybrid).  

ECS is seeking talented professionals to join our growing team supporting the Cybersecurity and Infrastructure Security Agency's (CISA) Technical Engineering and Support Services (TESS) program. TESS is CISA's integrated, capability-driven mission ecosystem designed to scale across mission and delivery spaces within the DHS/CISA/Cybersecurity Division. This is a hybrid role.

The Information Architect / Records Management Business Analyst will support the CISA Technical Engineering Support Services (TESS) contract, working within the Cybersecurity Division to design, implement, and maintain information architecture and records management frameworks that support threat hunting and cybersecurity operations. This role requires a Top Secret clearance and combines technical expertise in data architecture with business analysis capabilities to ensure efficient data organization, accessibility, and compliance across threat hunting operations.

• Design and implement information architecture frameworks to support threat hunting, cyber threat intelligence (CTI), and security operations
• Develop data taxonomies, classification schemes, and metadata standards for cybersecurity data and threat intelligence
• Create data models and information flow diagrams that support MITRE ATT&CK framework alignment and threat detection workflows
• Establish data governance policies and procedures for handling sensitive cybersecurity information and threat indicators
• Architect solutions for data integration across multiple security tools and platforms used in threat hunting operations

• Develop and maintain records management policies compliant with federal requirements (NARA, FISMA, and CISA-specific guidelines)
• Implement records retention schedules for threat hunt data, incident reports, and cybersecurity artifacts
• Ensure proper handling, storage, and disposition of classified and sensitive cybersecurity records
• Coordinate with CISA stakeholders on information lifecycle management for threat intelligence and security event data
• Maintain audit trails and documentation for compliance with federal cybersecurity mandates

• Gather and analyze business requirements from threat hunters, SOC analysts, and cybersecurity teams
• Translate technical and operational needs into information architecture requirements
• Conduct gap analysis between current and desired state information management capabilities
• Develop process improvement recommendations for data handling and records management workflows
• Create documentation including business requirements, functional specifications, and user guides

• Work closely with threat hunting teams, CTI analysts, and SOC personnel to understand data needs
• Collaborate with IT security engineers and system administrators on technical implementations
• Provide training and guidance to end-users on information architecture standards and records management procedures
• Support continuous monitoring and data analytics initiatives across CISA cybersecurity programs

Salary Range: $120,000 - $140,000

General Description of Benefits 

• Top Secret Clearance
• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Intelligence Studies, or related field, or equivalent experience.

• Minimum 5 years of experience in information architecture, data architecture, or records management
• At least 3 years of experience in cybersecurity environments, preferably supporting SOC operations, threat hunting, or incident response
• Experience with federal records management requirements and compliance frameworks
• Demonstrated experience with data governance, metadata management, and taxonomy development
• Experience working with cybersecurity data sources (SIEM logs, threat intelligence feeds, endpoint data, network traffic)

• Proficiency with data modeling tools and techniques
• Understanding of cybersecurity concepts including threat hunting, MITRE ATT&CK framework, and SOC operations
• Familiarity with security tools and platforms (SIEM, SOAR, threat intelligence platforms, EDR solutions)
• Knowledge of data formats and structures used in cybersecurity (JSON, XML, STIX/TAXII, CEF, etc.)
• Experience with data visualization and analytics tools (Elastic Stack, Splunk, or similar)

• Strong business analysis capabilities including requirements gathering and process improvement
• Excellent documentation skills with ability to create clear technical and business documentation
• Experience with project management and stakeholder engagement
• Strong communication skills for both technical and non-technical audiences