CSOC Cybersecurity Engineer Security Clearance

Position: CSOC Cybersecurity Engineer with Security Clearance
About Peraton Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world's leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace.

The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees solve the most daunting challenges that our customers face. Visit  to learn how we're keeping people around the world safe and secure. Program Overview About

The Role
** Position is Contingent Upon Award
** Peraton seeks innovative professionals who thrive in mission-critical environments and are passionate about protecting our national critical infrastructure. This is your chance to make an impact on one of the nation's vital organizations, working alongside leaders in cybersecurity engineering, operations, forensics, threat analysis, data science, and systems integration. Join Peraton in supporting a large infrastructure operator to defend its corporate and operations networks from nation-state attacks, ensure the confidentiality, integrity, and availability of its systems and operations infrastructure, and comply with various federal and internal cybersecurity mandates.

As a cybersecurity engineer in a 24x7x365 Cybersecurity Operations Center (CSOC), the position provides for the efficient operations and performance of the corporate Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems, Security Orchestration, Automation, and Response (SOAR) systems such as Splunk, Crowd Strike, Nessus Security Center, Axonius, Swimlane, Websense, Net Flow and other tools to identify and investigate anomalies and thwart cyberattacks.

The CSOC cybersecurity engineer duties include management and optimization of the SIEM/EDR/SOAR platforms to effectively collect, analyze, and respond to security threats in real-time, focusing on integrating log sources, creating detection rules, tuning alerts, automating workflows, and supporting incident response. The Cybersecurity Engineer will work with CSOC analysts, systems administrators, and managers to perform daily cybersecurity functions.

Primary Responsibilities:

The CSOC Security Engineer responsibilities will include:
* Corporate IT side operation, patching, performance and tuning of the CSOC SIEM, EDR, SOAR and related CSOC systems such as Splunk, Axonius, Crowd Stike, Swimlane, Websense, Net Flow, their system applications, log aggregators, forwarders and data storage systems' confidentiality, availability, integrity, and optimization, data input, and updating of data models and threat models

* Optimize and scale the corporate Splunk deployment, including forwarder architecture, index clustering and integration with security tools

* Coordination with the Operations Technology SIEM/EDR/SOAR cybersecurity engineer counterpart for the ongoing operation and health of core Splunk and related systems hardware, common information model and development of web framework, APIs, HTM for web Threat Widget integration

* Collection, analysis, and response of security threats in real-time, focusing on integrating log sources, creating detection rules, tuning alerts, automating workflows, and supporting incident response to improve the company's overall security posture and regulatory compliance.

* Develop and tune system correlation rules, create/customize dashboards, workbooks, and reports to identify suspicious system activities and network traffic and potential security incidents for analysis by CSOC cybersecurity analysis ts, tune SIEM/EDRSOAR to reduce false positives (alert fatigue) improve alert fidelity, and optimize data usage
* Responsible for SIEM/EDR system monitoring and verification of log processing, troubleshooting, onboard existing and new log data sources (such as servers, firewalls, cloud services), ensure proper and secure log data ingestion, parsing, and storage of and managing the log lifecycle Additional Responsibilities:
* Create new log and threat source types, field extractions, processing, etc. integrate CSOC tools with other CSOC and OT systems and threat intelligence platforms and configure systems for automated response actions

* Act as Point of Contact (POC) for SIEM/EDR ingestion of new data based on internal company customer requirements for network and system monitoring; and coordinate with other organizations such as IT and field operations to meet their security monitoring and threat detection system needs

* Responsible for developing and maintaining all SIEM/EDR/SOAR System Security Plans (SSP) and other documentation required, including systems technical…