Cyber Secuirty Engineer

Responsibilities Professionals in cybersecurity engineering are responsible for designing, implementing, and maintaining security controls and solutions to protect information systems and assets from cyber threats within organizations. They utilize their expertise in cybersecurity principles, network security, and secure coding practices to develop robust and resilient security architectures and defenses. Typical responsibilities include conducting risk assessments and security audits to identify vulnerabilities and assess security posture, designing and implementing security controls and countermeasures to mitigate risks and threats, and integrating security features and mechanisms into software, applications, and infrastructure components.

Cybersecurity engineering roles also involve monitoring and analyzing security logs and alerts to detect and respond to security incidents and breaches, and collaborating with cross-functional teams to address security requirements and priorities in system development and operations. Additionally, professionals may be involved in security testing and validation, such as penetration testing and security code reviews, to identify and remediate security weaknesses and ensure compliance with security standards and regulations.

Their expertise in areas such as encryption, access control, and threat intelligence enables organizations to establish and maintain a strong cybersecurity posture, protect sensitive data and assets, and mitigate cyber risks effectively.

You are responsible for leading individual projects, people, or technical/functional solutions. As an employee, you:
Work on advanced problems or assignments of large scope, impact, and importance, applying broad and deep knowledge of professional specialty and business dynamics. Work on assignments in multiple business or technical areas; apply advanced concepts and understanding of policies, procedures, and techniques. Build and maintain effective relationships for customer service and project support; demonstrate initiative and proactively identify and communicate needs.

Influence at the team or department level; participate in policy and procedure development. Receive general supervision, apply seasoned judgment autonomously.

Responsibilities:

Engineer, configure, and maintain SIEM platforms and security monitoring tools within a 24/7/365 enterprise Security Operations Center protecting federal systems and data across cloud and on premises environments.

Develop, test, and tune custom detection rules, correlation searches, and automated alert logic calibrated to environment specific user behaviors, asset profiles, and threat patterns.

Investigate cybersecurity incidents by correlating security events, behavioral analytics, threat intelligence, and log data to identify threats, anomalies, and indicators of compromise.

Design and implement automated workflows and SOAR playbooks to streamline incident triage, case enrichment, and escalation processes.

Develop and maintain engineering documentation including design documents, configuration records, test plans, and architecture diagrams for all SOC tools and security solutions.

Collaborate with threat intelligence, insider threat, and fraud analytics teams to develop detection capabilities that integrate behavioral, identity, and network telemetry.

Create and maintain SOPs, desk guides, and playbooks while mentoring junior engineers and analysts on detection development and investigative techniques.

Ensure all cybersecurity solutions comply with NIST frameworks, federal security policies, and applicable mandates including FISMA, RMF, and Zero Trust Architecture guidelines.

All applicants will need to be able to work on-site at the client location in New Carrollton, MD.

Required Qualifications Bachelor's degree with 7 years of related experience

Experience with Splunk ES/SOAR in an enterprise SOC environment

Experience developing custom detection rules, correlation searches, and automated playbooks

Knowledge of NIST Cybersecurity Framework, NIST SP 800 53, FISMA, and RMFRecent IRS Cyber experience (ex. within the last 2 years)
Ability to work on-site in New Carrollton, MD. Desired Qualifications Active IRS Moderate Risk Background Investigation Cyber defense certification such as: CISSP, Splunk Certified Cybersecurity Defense Analyst Experience supporting federal cybersecurity operations

Experience with MITRE ATT&CK framework mapping for detection coverage analysis

Experience mentoring junior…