Job description
Description
Dragonfli Group is a cybersecurity and IT consulting firm providing services to federal agencies and Fortune 100 enterprises. Headquartered in Washington, DC, Dragonfli supports clients in securing mission-critical systems across on-site, hybrid, and fully remote environments.
We're seeking a hands-on Cyber Security Consultant to lead an AI Security Operating Capability workstream, helping a large federal agency stand up the ability to review, approve, monitor, and secure AI use cases running on Microsoft Power Platform. As workstream lead, this consultant will independently navigate Microsoft Copilot Studio, Power Automate, and Dataverse to identify where security controls apply, configure and validate those controls directly, and own the client relationship through delivery and knowledge transfer. This is a hands-on technical leadership role — not a policy-advisory position — and requires approximately 7+ years of cybersecurity/GRC experience, including at least 3 years configuring security controls directly within Microsoft Power Platform and/or Copilot environments.
Candidates with previous government contracting experience are preferred. U.S. Citizenship or Permanent Residency is required. If hired, all work related to this role must be performed within the continental U.S.
Please note that this is a contract opportunity involving a 4- to 6-month engagement. This is a fully remote role.
Key Responsibilities:
Lead the assessment of existing security tooling and identify gaps against AI-specific risk domains for Power Platform and Copilot
Identify and prioritize security controls aligned to Microsoft security benchmarks and industry best practices for Power Platform/Copilot Studio and connected AI use cases
Own execution of control configuration, testing, and documentation (runbooks) across selected AI use cases (chatbots, email automation, analytics/ML, computer vision) directly within Copilot Studio, Power Automate, Dataverse, and related Microsoft security tools (Entra, Purview)
Document detailed control specifications (objective, description, owner, implementation guidance, evidence/testing method) and overlay implemented controls onto existing architecture documentation
Direct and quality-check the work of the supporting consultant on the workstream
Lead client-facing knowledge transfer sessions so the client's security team can operate controls and the intake process independently going forward
Serve as the primary point of contact and escalation path with client security and platform teams throughout configuration and validation
Report workstream status and risk to engagement leadership
Requirements
Must-Have:
Minimum ~7 years of cybersecurity/GRC experience, including demonstrated leadership of a technical security workstream
Strong, hands-on technical proficiency with Microsoft Copilot (including Copilot Studio) and the Power Platform (Power Automate, Dataverse) — able to independently navigate these platforms to identify where controls apply and configure/enable them directly, not just advise at a policy level
Working knowledge of Microsoft security suite tools (Entra, Purview) and how they integrate with Power Platform/Copilot environments
Demonstrated experience with security control design, testing, and runbook/technical documentation
Strong client-facing communication skills, with experience leading working sessions and delivering knowledge transfer
U.S. Citizenship or Permanent Residency
Preferred / Nice-to-Have:
Prior experience on federal contracting engagements
Relevant certifications (e.g., CISSP, Security+, Microsoft SC-900/SC-401 or equivalent)
Familiarity with AI/ML security risk domains and Microsoft security benchmarks/baselines
Experience directing or mentoring junior consultants within a workstream
Skill(s)
Technical Skills:
Microsoft Copilot Studio
Power Automate
Microsoft Dataverse
Microsoft Entra ID
Microsoft Purview
AI/ML security risk assessment
Security control design, configuration, and testing
Technical runbook documentation
Microsoft security benchmarks/baselines
GRC frameworks
Soft Skills:
Client-facing communication and workshop facilitation
Workstream leadership and ownership
Stakeholder management
Knowledge transfer and training delivery
Cross-functional collaboration
Benefits
Dragonfli Group offers a comprehensive benefits package that includes:
Medical: Multiple POS health plan options including an HSA-compatible plan
Dental: PPO coverage for preventive, basic, and major services
Vision: Annual exam, frames, lenses, and contact lens allowance
401(k): Employer match up to 5% of eligible compensation
Long-Term Disability: 100% employer-paid coverage at 50% of pre-disability earnings
Life Insurance & AD&D: 100% employer-paid coverage valued at $10,000 each
PTO: 15–25 days annually based on tenure
Paid Federal Holidays: All 11 federal holidays observed
Originally posted on Himalayas
Who can apply
Eligible countries: United States. Accepted UTC offsets: UTC-10, UTC-9, UTC-8, UTC-7, UTC-6, UTC-5, UTC+14. Review the full description for employer-specific work authorization, residency and schedule requirements.