Cyber Security Engineer

Description

The company is hiring a cyber security engineer to design, connect and improve the security tooling behind a mission-critical Command and Control (C2) enterprise with more than 5,000 users across the INDOPACOM theater.

The role combines SIEM, SOAR and Linux automation into one intelligence-driven platform that provides usable telemetry, automated responses and real-time risk visibility, and works closely with engineers, SOC operators and senior government leaders on the next generation of Zero Trust operations.

The company is a private defense and government solutions business founded in 1989 and headquartered in Reston, Virginia. It works on data science, software development, network engineering, ISR and logistics.

Responsibilities

• Assess, design and keep current the roadmap for security capabilities against the DoD Zero Trust Reference Architecture and Target-level activities across all seven pillars.
• Turn Zero Trust requirements into concrete configurations, segmentation rules and policies, and document how each control maps to the architecture.
• Evaluate, pilot and integrate new security technologies that close Zero Trust gaps.
• Design, deploy and tune the SIEM Security platform, covering agent policies, integrations, index lifecycle management, data tiers and cluster sizing.
• Build data pipelines that collect, filter, enrich and normalize data to a Common Schema before it reaches the SIEM, keeping volume and cost under control.
• Develop, test and tune detection rules, dashboards and alerts mapped to MITRE ATT&CK, cutting false positives with the SOC.
• Design, deploy and maintain the SOAR platform and its integrations with the SIEM, endpoint, vulnerability, identity, network and ticketing systems.
• Build and test playbooks for alert triage, enrichment, containment such as isolating hosts or disabling accounts, and case management, adding human approval gates where required.
• Support the Automation and Orchestration pillar of the DoD Zero Trust strategy, including integration of policy decision and enforcement.
• Engineer and harden enterprise endpoint protection and EDR platforms, including DoD-mandated endpoint security solutions, covering policy, host intrusion prevention and device control.
• Keep agent health, deployment coverage and policy compliance current across Windows and Linux endpoints, and send endpoint telemetry to the SIEM.
• Run and improve enterprise vulnerability scanning to meet DoD requirements such as ACAS, including credentialed scan design, scan zones and reporting.
• Drive remediation by matching findings to asset owners and patch status, track IAVM compliance, and set risk-based remediation priorities.
• Build, maintain and upgrade the enterprise Linux server infrastructure, including hardened standard builds, identity integration, performance, availability and lifecycle replacement.
• Run the Linux content lifecycle, patching and errata workflows so tested updates reach every environment on time.
• Automate STIG and SCAP compliance through configuration-as-code and report compliance status to leadership.
• Implement and validate STIGs and SRGs, and produce RMF artifacts, POA&Ms and evidence for assessments and inspections such as CORA.
• Work with vendors, other agencies and coalition partners on the program's behalf.
• Contribute to After Action Reports (AARs) and submit Weekly Activity Reports (WARs) as the contract requires.

Requirements

• Active, in-scope Top Secret clearance with SCI eligibility, and a valid US passport.
• Either a bachelor's degree in Cyber Security, Computer Science, Information Systems, Computer Engineering or a related field plus 5+ years of experience, or 9+ years of cybersecurity engineering experience in a DoD or classified environment.
• 3+ years of hands-on engineering work, meaning deploying, tuning and integrating rather than only operating, with at least three of: SIEM (Elastic preferred), SOAR, security data pipelines, EDR, enterprise vulnerability management, and Linux configuration and patch management.
• DoD 8570 IAT-II compliance through one of: Security+ CE, CCNA, CND, CySA+, GICSP, GSEC or SSCP.
• Working knowledge of Zero Trust concepts, the DoD Zero Trust Reference Architecture, and tiered or privileged access models.
• Solid administration skills in Linux and Windows Server, including Active Directory, Kerberos, PKI and DNS fundamentals.
• Experience implementing STIGs and SRGs, running SCAP scans and producing RMF documentation in DoD environments.
• Scripting or automation in at least one of Python, PowerShell, Bash or Ansible, including REST API integrations.
• Clear written and verbal communication, including briefing technical topics to senior leadership.
• Preferred: hands-on engineering across all the capability areas above, including building SOAR playbooks in production.
• Preferred: Elastic certification (Elastic Certified Engineer or Analyst) and vendor certifications for the SOAR, EDR, data pipeline or vulnerability management platforms in use.
• Preferred: Red Hat certification (RHCSA or RHCE) and experience with Linux identity management integrated with Active Directory trusts.
• Preferred: experience designing detections with MITRE ATT&CK and building SOC workflows and metrics.
• Preferred: experience with privileged access workstations (PAWs), tiered or ESAE-style administration, and phishing-resistant MFA (CAC/PIV).
• Preferred: familiarity with Data Centric Security, NSA CSfC capability packages and Cross Domain Solutions (CDS).
• Preferred: experience with virtualization and hyperconverged platforms from a security-hardening perspective.

Conditions

Normal office working conditions.

Mission operations run on a 24/5 baseline, with possible evening, overnight, weekend, exercise, contingency and surge coverage based on contract and mission needs.

The environment is fast paced and deadline driven.

All qualified applicants will be considered without regard to any protected characteristic.