Cyber Security Engineer II

DPP is seeking a Cyber Security Engineer for an opportunity with our client in the healthcare insurance industry.

• Work location:
  
  Partial onsite (Tues., Wed., Thurs. onsite) and as needed
• Duration: 12 months
• Term: W2 position
• Work authorization:
  Candidates must be eligible to earn a low-level (Public Trust) US security clearance.

• Publishes and maintains an AI threat detection catalog using available telemetry data
• Deploys prioritized detection rules and performs regular tuning on a set schedule
• Reduces repeat false positive alerts through tuning and adjustment of detection logic
• Improves alert triage and escalation times for AI‑related security events
• Uses enrichment to support more efficient alert review and handling
• Establishes baseline monitoring for approved AI tools
• Sets and monitors thresholds to identify abnormal AI tool usage
• Tracks and identifies risky AI usage patterns
• Supports remediation of identified AI‑related risks
• Produces recurring reports on AI usage and associated risks
• Develops and documents AI‑focused incident response runbooks
• Participates in tabletop exercises to test and validate response procedures
• Updates runbooks and detection rules based on lessons learned from exercises
• Works with cross‑functional teams including leadership, architects, and senior technical staff
• Communicates findings and updates clearly to both technical and non‑technical audiences

• Experience working with security operations, detection engineering, or incident response processes
• Hands‑on experience using SIEM and SOAR tools for monitoring and response workflows
• Ability to develop or use automation and scripting (e.g., Python, KQL, SPL) to support security operations
• Working knowledge of common AI/ML security risks such as prompt injection, data leakage, and over‑reliance on AI outputs

• Previous experience working in a Security Operations Center (SOC) environment
• Industry certifications related to artificial intelligence or machine learning

• Small CSOC team (about 13 people) split between analysts and engineers, working closely together on day‑to‑day security operations.
• Currently focused on integrating a new SIEM and rolling out AI‑related security capabilities across the environment.
• Hours:
  
  8AM – 5PM, Monday–Friday. Overtime, travel, weekends, and off hours are possible but likely rare.

6 years of job‑related technical experience.

• Bachelor’s degree in Computer Science, Information Technology, or other job‑related degree
• OR, Associate’s degree in CS, IT, or other job‑related degree plus 2 years of work‑related experience
• OR, 4 years of job‑related work experience (total 10 years without a degree)

This role requires the ability to obtain a Public Trust US security clearance, which requires a thorough background search and citizenship. Residency requirements may apply.
EOE/AA/V/D