Cyber Security Engineer

Description

Join the ES&S team as we craft the future of voting in the United States! On our team, you will push boundaries to provide solutions that meet the industry’s ever-evolving needs. Our people apply their innovative perspective to challenges big and small, and ES&S provides the resources to make our employees’ vision a reality.

A Cyber Security Engineer at ES&S designs, implements, maintains, and improves enterprise cybersecurity technologies and controls that protect the organization’s systems, networks, applications, and data. This position serves as a technical security resource supporting security monitoring, threat detection, incident response, vulnerability management, security architecture, and the development and maintenance of cybersecurity policies and standards. Ideal candidates will have 3+ years of progressive cybersecurity experience in the following areas:

• Hands-on experience administering and configuring Microsoft Sentinel within Microsoft Azure.
• Experience creating and managing Data Collection Rules (DCRs), Log Analytics Work spaces, Azure Monitor Agent (AMA), and Logic Apps.
• Experience configuring Sentinel data connectors using built-in Content Hub solutions and custom data connectors.
• Knowledge of onboarding and managing Syslog, CEF, API, and custom log data sources.
• Experience creating DCR transformations and custom tables to filter, parse, transform, and route security telemetry.
• Knowledge of monitoring data ingestion and storage consumption, including managing data across Analytics and Data Lake tiers to optimize storage and cost.
• Experience creating Sentinel Workbooks to visualize security metrics, ingestion trends, data statistics, and operational performance.
• Strong working knowledge of Kusto Query Language (KQL) for data analysis, troubleshooting, reporting, and advanced threat hunting.

• Hands-on experience supporting and administering Microsoft Defender XDR, including incident and alert management, investigation, and response.
• Experience using Advanced Hunting and KQL to investigate threats, analyze security telemetry, and identify potentially malicious activity across endpoints, identities, email, and cloud services.
• Experience with Exposure Management and Vulnerability Management, including identifying, tracking, and prioritizing vulnerabilities and CVEs for remediation.
• Experience onboarding Windows endpoints and servers into Microsoft Defender for Endpoint, validating sensor health, and troubleshooting onboarding and connectivity issues.
• Working knowledge of Attack Surface Reduction (ASR) rules, including configuration, audit/enforcement modes, exclusions, testing, and troubleshooting.
• Experience configuring and managing alert suppression and tuning to reduce false positives and improve security operations efficiency.
• Experience investigating incidents and performing endpoint response and containment actions through Microsoft Defender XDR.
• Preferred experience using Microsoft Sentinel with Microsoft Defender XDR's unified security operations experience, including incidents, hunting, analytics, investigation, and response across both platforms.

• Hands-on experience with Splunk Enterprise Cloud and onboarding new security and operational data sources.
• Experience configuring and managing data inputs, including HTTP Event Collector (HEC).
• Working knowledge of indexes, source types, data inputs, and data ingestion concepts.
• Fundamental knowledge of Search Processing Language (SPL) for searching, filtering, analyzing, and reporting on data.
• Experience validating and troubleshooting data ingestion, parsing, indexing, and source-type assignments.
• Experience creating and scheduling Splunk searches and reports for security monitoring, operational reporting, and data analysis.

• Preferred hands-on experience with Cisco XDR, including integrating Cisco and third-party security products to ingest and correlate security telemetry.
• Experience performing security investigations in Cisco XDR, including reviewing detections, investigating affected assets, and using available response actions to support threat containment and remediation.
• Working knowledge of Cisco Umbrella SIG and Cisco Secure Access, including troubleshooting security policies, web access, DNS, proxy, and connectivity issues.
• Understanding of SSL/TLS inspection, including certificate-based decryption, policy exclusions, certificate trust issues, and…