Sr. Cyber Defense Architect Security Clearance

Position: Sr. Cyber Defense Architect with Security Clearance

Sr. Cyber Defense Architect with Security Clearance

Location:

Fort Meade, MD |

Employment type:

Full‑time | Clearance: TS/SCI with CI Polygraph required

Overview

We are seeking a Sr. Cyber Defense Architect who brings together deep expertise across offensive cyber techniques, blue‑team defensive operations, and Splunk engineering to build, evaluate, and strengthen enterprise security from the kernel to the application layer. This is not a traditional SOC analyst or Splunk admin role.

Key Responsibilities Offensive Understanding & Adversary Insight

• Analyze and explain how exploits interact with CPU rings, kernels, drivers, and OS structures.
• Identify exploitation paths, misconfigurations, and lateral movement opportunities.
• Demonstrate attacker methods and help design the defenses to stop them.

Defensive Cyber & SOC Operations

• Investigate alerts with a deep understanding of how system internals behave under attack.
• Conduct root‑cause analysis across logs, processes, memory, and network activity.
• Build detection logic tied directly to attacker behavior, not generic signatures.

Threat Hunting

• Perform proactive, hypothesis‑driven hunts across enterprise telemetry.
• Map hunt results to attack chains and OS‑level artifacts.
• Identify blind spots and propose visibility improvements.

Splunk Architecture & Analytics

• Administer Splunk Enterprise, including data ingestion, parsing, indexes, and forwarders.
• Develop high‑fidelity SPL queries, dashboards, correlation searches, and threat detections.
• Normalize logs for consistent detection across OS, network, cloud, containers, and application layers.
• Ensure logs reflect true system behavior, not noisy or low‑value events.

System & OS Internals Expertise

• Explain OS behavior from kernel mode to user mode and across the rings of control.
• Understand memory management, syscalls, interrupts, drivers, services, and authentication flows.
• Diagnose Linux and Windows artifacts that signal compromise or misconfiguration.

VM, Hypervisor, and Container Knowledge

• Understand how VMs virtualize hardware and how containers share the kernel.
• Evaluate how vulnerabilities behave differently in VM vs containerized environments.
• Assess whether a vulnerability is meaningful based on system architecture and exposure.

Policy Shaping & Risk Context

• Assess vulnerability severity in context – not every critical CVE is a critical risk.
• Provide recommendations on which vulnerabilities are operationally relevant.
• Shape detection, hardening, and response policies based on real technical behavior.
• Support leadership by translating system‑level findings into clear, actionable guidance.

Minimum Qualifications

• Clearance:
  Active TS/SCI with CI Polygraph required.
• Deep understanding of Linux and Windows internals, including kernel functions, process behavior, memory, and logging.
• Strong hands‑on experience with offensive tooling, exploitation concepts, and attacker trade‑craft.
• Strong defensive background in SOC operations, detection engineering, and threat analysis.
• Ability to build and optimize raw SPL, develop detections, and administer Splunk data flows.
• Understanding of network stacks, OSI model behavior in the OS, and how telemetry is generated.

Hybrid Skillset Requirements

• Comfortable switching between attacker mindset and defender mindset.
• Able to articulate complex system interactions clearly and accurately.
• Understand system impact and can differentiate theoretical vs practical risk.
• Capable of building detections from first‑principles, not relying on feeds.

Soft Skills

• Strong communication skills across technical and non‑technical stakeholders.
• Ability to walk red, blue, and purple team members through system‑level logic.
• Detail‑oriented thinker who can contextualize threats within mission needs.

Desired Background

• Senior Red Team Operator with Blue Team experience.
• Senior SOC Analyst with OS internals and detection engineering background.
• Splunk Engineer with adversary and system knowledge.
• Cyber Defense Operator with purple team exposure.
• Security Architect with hands‑on operational experience.

Compensation & Benefits

Salary Range: $200,000 - $255,000 annually. Final compensation will depend on experience, qualifications, internal…