Cyber Security Engineer

Description

The company is a global technology and professional services firm with about 26,000 staff in more than 50 countries. It serves U.S. government, defense and intelligence agencies with work in AI, cloud, cyber and software development.

This role is a technical lead position supporting a Cybersecurity Service Provider (CSSP) and Defensive Cyberspace Operations (DCO). The work protects mission systems that detect, track and intercept threats, and the lead guides analysts, engineers and responders against capable adversaries under tight deadlines.

Responsibilities

• Act as the senior technical authority for incident response, cyber defense, threat hunting, forensics, vulnerability management and threat emulation.
• Give subject-matter guidance so technical work meets DoD and client cyber requirements, CJCSM 6510.01B and CSSP governance standards.
• Plan, coordinate and run technical work for mission-essential requirements.
• Oversee round-the-clock monitoring, detection and incident classification under Cyberspace Domain Awareness.
• Keep response times within CSSP Mean Time to Respond (MTTR) targets.
• Lead teams on vulnerability analysis, ACAS posture rollups, IAVM trending, PPSM compliance checks and endpoint security rollups.
• Oversee forensic analysis to NIST SP 800-86, keep chain-of-custody intact and deliver complete forensic case reports.
• Lead intelligence-driven threat hunts that combine OSINT and CSINT with internal telemetry to find advanced adversary TTPs.
• Lead the building of analytics, rulesets and countermeasures for SIEM, EDR and Elastic Stack tools in the CSSP toolset.
• Support threat emulation using GFE tools to test defenses against realistic adversary behavior.
• Oversee technical documents, including SOPs, TTPs, CTOs, COAs, forensic and vulnerability reports and training materials.
• Make sure outputs follow DoD plain-language standards and use Government-approved formats.
• Support RMF lifecycle work: SSP updates, control assessments, POA&M management, audit log review and incident response testing.
• Lead work on Elastic dashboards, data enrichment pipelines, anomaly detection models and threat analytics.
• Oversee Cybersecurity Business Intelligence dashboards on unclassified and classified networks, with daily refreshed, validated data pipelines.
• Drive automation and testing that moves defense toward proactive, data-driven operations.

Requirements

• Bachelor's degree in cybersecurity, computer science, engineering or a related field, such as cyber defense, cyber operations, forensic sciences, information assurance or information system security.
• Active CISSP certification.
• 7+ years of cybersecurity engineering or cyber operations work in DoD or federal environments.
• 3+ years in a technical leadership role.
• Proven experience leading incident response, threat hunting, vulnerability management or forensic analysis teams.
• Extensive hands-on work with SIEM and EDR platforms, Elastic Stack, ACAS and cyber defense analytics.
• Strong working knowledge of RMF.
• Deep understanding of incident response processes and detection engineering.
• Experience writing SOPs, TTPs, dashboards, forensic reports and cyber analytics.
• Strong leadership and team coordination across different cyber and CSSP disciplines.
• Clear communication with both technical staff and executives.
• Strong analytical and problem-solving skills under pressure.
• Ability to work across multiple classification levels and sensitive environments.
• U.S. citizenship required.
• Secret clearance required; interim Secret currently held and ability to obtain Top Secret/SCI required.

Conditions

Based on-site in Huntsville, Alabama. Telework is possible only when authorized, on a situational basis.

Scheduled at 40 hours per week.

Travel is less than 10%.

The likely salary range is $111,155 to $150,385. This is not a guarantee. Pay depends on experience and geographic location, may depend on contract requirements, and could fall outside this range.

Hiring includes an identity verification process using biometrics and AI. Virtual interviews require you to be on camera, and your biometric data will be used for verification and security.

The company is an equal opportunity employer that welcomes individuals with disabilities and protected veterans.

Benefits

• Medical plans, some with Health Savings Accounts, plus dental and vision plans.
• 401(k) plan with pre-tax and post-tax contributions up to IRS limits and a company match.
• Full flex work weeks where possible.
• Paid time off for vacation, sick and personal time, holidays, parental, military, bereavement and jury duty.
• Short- and long-term disability, life, accidental death and dismemberment, personal accident, critical illness and business travel accident insurance, provided or available.
• Preferred extras: ISSAP (strongly preferred), ISSEP, CISM, GIAC GCIH, GCIA or GCED, CCSP and PMP certifications, Top Secret clearance, GIAC, Elastic or DoD 8140/8570 certifications (such as GREM, GCFA, GCTI, CEH), experience in CTE environments or advanced adversary simulation, prior leadership in an accredited CSSP, and experience overseeing dashboard or data pipeline engineering.