Cyber Security Engineer

• Assess, design and maintain the roadmap for security capabilities aligned to the DoD Zero Trust Reference Architecture and Target-level activities across all seven pillars.

• Assess, design and maintain the roadmap for security capabilities aligned to the DoD Zero Trust Reference Architecture and Target-level activities across all seven pillars.
• Translate Zero Trust requirements into concrete configurations, segmentation rules and policies, and document how each control maps to the architecture.
• Evaluate, pilot and integrate new security technologies to close Zero Trust capability gaps.

• Design, deploy and tune SIEM Security, including Agent policies, integrations, index lifecycle management, data tiers and cluster sizing.

• Design, deploy and tune SIEM Security, including Agent policies, integrations, index lifecycle management, data tiers and cluster sizing.
• Engineer security data pipelines that collect, filter, enrich and normalize data to a Common Schema before it reaches the SIEM, controlling volume and cost.
• Develop, test and tune detection rules, dashboards and alerts mapped to MITRE ATT&CK, reducing false positives in partnership with the SOC.

• Design, deploy and maintain the SOAR platform and its integrations with the SIEM, endpoint, vulnerability, identity, network and ticketing systems.

• Design, deploy and maintain the SOAR platform and its integrations with the SIEM, endpoint, vulnerability, identity, network and ticketing systems.
• Build and test playbooks for alert triage, enrichment, containment (e.g., isolating hosts, disabling accounts) and case management, with human approval gates where required.
• Support the Automation and Orchestration pillar of the DoD Zero Trust strategy, including policy decision and enforcement integration.

• Engineer and harden enterprise endpoint protection and EDR platforms, including DoD-mandated endpoint security solutions, covering policy, host intrusion prevention and device control.

• Engineer and harden enterprise endpoint protection and EDR platforms, including DoD-mandated endpoint security solutions, covering policy, host intrusion prevention and device control.
• Maintain agent health, deployment coverage and policy compliance across Windows and Linux endpoints, and forward endpoint telemetry into the SIEM.

• Operate and optimize enterprise vulnerability scanning in line with DoD requirements (e.g., ACAS), including credentialed scan design, scan zones and reporting.

• Operate and optimize enterprise vulnerability scanning in line with DoD requirements (e.g., ACAS), including credentialed scan design, scan zones and reporting.
• Drive remediation by correlating findings with asset owners and patch status, tracking IAVM compliance and producing risk-based remediation priorities.

• Engineer, build and maintain the enterprise Linux server infrastructure, including standard hardened builds, identity integration, performance and availability, upgrades and lifecycle replacement

• Engineer, build and maintain the enterprise Linux server infrastructure, including standard hardened builds, identity integration, performance and availability, upgrades and lifecycle replacement
• Engineer Linux content lifecycle, patching and errata workflows to deliver timely, tested updates across environments.
• Automate STIG and SCAP compliance with configuration-as-code, and report compliance status to leadership.

• Implement and validate STIGs and SRGs, and produce RMF artifacts, POA&Ms and evidence for assessments and inspections (e.g., CORA).
• Interact with vendors, other agencies and coalition partners on behalf of the program.
• Contribute to After Action Reports (AARs) and submit Weekly Activity Reports (WARs) in accordance with contract requirements.

• Active, in-scope Top Secret clearance with SCI eligibility, and a valid US passport.

• Active, in-scope Top Secret clearance with SCI eligibility, and a valid US passport.
• Bachelor's degree in Cyber Security, Computer Science, Information Systems, Computer Engineering or a related field and 5+ years of experience OR 9+ years of cybersecurity engineering experience in DoD or classified environment.
• 3+ years hands-on engineering (deploying, tuning and integrating, not only operating) with at least three of: SIEM (Elastic preferred), SOAR, security data pipelines, EDR, enterprise vulnerability management, and Linux configuration and patch management.
• DoD 8570 IAT-II compliant (Security+ CE, CCNA, CND, CySA+, GICSP, GSEC, or SSCP).
• Working knowledge of Zero Trust concepts, the DoD Zero Trust Reference Architecture, and tiered or privileged access models.
• Solid administration skills in Linux and Windows Server, including Active Directory, Kerberos, PKI and DNS fundamentals.
• Experience implementing STIGs and SRGs, SCAP scanning and RMF documentation in DoD environments.
• Scripting or automation in at least one of Python, PowerShell, Bash or Ansible, including REST API integrations.
• Clear written and verbal communication, including the ability to brief technical topics to senior leadership.

• Hands-on engineering experience across all the capability areas above, including building SOAR playbooks in production.
• Elastic certifications (Elastic Certified Engineer or Analyst) and vendor certifications for the SOAR, EDR, data pipeline or vulnerability management platforms in use.
• Red Hat certifications (RHCSA or RHCE), and experience with Linux identity management integrated with Active Directory trusts.
• Experience designing detections with MITRE ATT&CK and building SOC workflows and metrics.
• Experience with privileged access workstations (PAWs), tiered or ESAE-style administration, and phishing-resistant MFA (CAC/PIV).
• Familiarity with Data Centric Security, NSA CSfC capability packages and Cross Domain Solutions (CDS).
• Experience with virtualization and hyperconverged platforms from a security-hardening perspective.