Senior Cybersecurity Consultant - MS Copilot & Power Platform

About the role

Dragonfli Group is a cybersecurity and IT consulting firm providing services to federal agencies and Fortune 100 enterprises. Headquartered in Washington, DC, Dragonfli supports clients in securing mission-critical systems across on-site, hybrid, and fully remote environments. We're seeking a hands-on Cyber Security Consultant to lead an AI Security Operating Capability workstream, helping a large federal agency stand up the ability to review, approve, monitor, and secure AI use cases running on Microsoft Power Platform. As workstream lead, this consultant will independently navigate Microsoft Copilot Studio, Power Automate, and Dataverse to identify where security controls apply, configure and validate those controls directly, and own the client relationship through delivery and knowledge transfer. This is a hands-on technical leadership role — not a policy-advisory position — and requires approximately 7+ years of cybersecurity/GRC experience, including at least 3 years configuring security controls directly within Microsoft Power Platform and/or Copilot environments. Candidates with previous government contracting experience are preferred. U.S. Citizenship or Permanent Residency is required. If hired, all work related to this role must be performed within the continental U.S.

Responsibilities

• Lead the assessment of existing security tooling and identify gaps against AI-specific risk domains for Power Platform and Copilot
• Identify and prioritize security controls aligned to Microsoft security benchmarks and industry best practices for Power Platform/Copilot Studio and connected AI use cases
• Own execution of control configuration, testing, and documentation (runbooks) across selected AI use cases (chatbots, email automation, analytics/ML, computer vision) directly within Copilot Studio, Power Automate, Dataverse, and related Microsoft security tools (Entra, Purview)
• Document detailed control specifications (objective, description, owner, implementation guidance, evidence/testing method) and overlay implemented controls onto existing architecture documentation
• Direct and quality-check the work of the supporting consultant on the workstream
• Lead client-facing knowledge transfer sessions so the client's security team can operate controls and the intake process independently going forward
• Serve as the primary point of contact and escalation path with client security and platform teams throughout configuration and validation
• Report workstream status and risk to engagement leadership

Requirements

Must-Have:

• Minimum ~7 years of cybersecurity/GRC experience, including demonstrated leadership of a technical security workstream
• Strong, hands-on technical proficiency with Microsoft Copilot (including Copilot Studio) and the Power Platform (Power Automate, Dataverse) — able to independently navigate these platforms to identify where controls apply and configure/enable them directly, not just advise at a policy level