Cybersecurity Engineer - SIEM Operations

Protect3 Solutions is a cybersecurity services and solutions provider supporting federal government agencies in protecting the confidentiality, integrity, and availability of critical information systems. As a small business, we specialize in security engineering, Security Information and Event Management (SIEM), security operations, and cybersecurity infrastructure.

We partner with leading technology providers, including Splunk, Cribl, Elastic, Microsoft, and others, to deliver innovative cybersecurity solutions that strengthen our customers' security posture.

At Protect3 Solutions, we invest in our employees through competitive benefits, professional development opportunities, and support for achieving advanced industry certifications.

Protect3 Solutions is seeking a Cybersecurity Engineer to support a U.S. Air Force program at Scott Air Force Base, Illinois.

This position focuses on SIEM operations, security monitoring, log analysis, vulnerability management, and incident coordination. The Cybersecurity Engineer will work primarily with Splunk to develop and maintain security monitoring capabilities, onboard data sources, analyze security events, and support cybersecurity operations across the program.

The role will also support the implementation and integration of the Elastic Stack as the program expands its security monitoring capabilities.

• Key Responsibilities:
  
  SIEM Operations and Content Development:
  Manage and maintain security monitoring capabilities within Splunk, including developing and tuning searches, correlation rules, alerts, and dashboards to support security operations.
• Log Analysis and Review:
  Analyze security logs from various systems, applications, and network devices to identify suspicious activity, security events, and potential threats.
• Data Onboarding and Integration:
  Configure and troubleshoot log ingestion from new and existing data sources, ensuring proper parsing, field extraction, normalization, and data quality.
• Vulnerability Management Support:
  Review vulnerability assessment reports, evaluate findings, identify security risks, and coordinate remediation activities with appropriate stakeholders.
• Security Incident Coordination:
  Investigate and review security events, support incident triage, and coordinate incident response activities among technical teams, security personnel, and program stakeholders.
• Elastic Stack Implementation:
  Support the deployment, configuration, and integration of Elastic Stack technologies to enhance log management, search, and security analytics capabilities.
• Security Operations Improvement:
  Identify opportunities to improve monitoring coverage, detection capabilities, and operational efficiency through automation, tuning, and process improvements.
• Documentation and Reporting:
  Maintain technical documentation, operational procedures, and security reports to support program requirements and continuous improvement.
• Qualifications
  
  Required Qualifications:
  
  Experience in cybersecurity operations, security engineering, SIEM administration, or a related technical security role.
• Hands-on experience with Splunk Enterprise or Splunk Cloud, including searching, log analysis, dashboards, alerts, and security monitoring.
• Experience onboarding and troubleshooting security log sources, including familiarity with common logging formats, protocols, and ingestion methods.
• Understanding of security event analysis, incident detection, investigation, and response processes.
• Familiarity with vulnerability management processes, including reviewing vulnerability scan results and coordinating remediation.
• Knowledge of networking fundamentals, operating systems, and common security technologies.
• Strong analytical and troubleshooting skills, with the ability to investigate complex technical issues.
• Excellent communication skills and the ability to coordinate effectively with technical teams, security stakeholders, and government personnel.
• Ability to work on-site at Scott Air Force Base, Illinois.
• Preferred Qualifications:Experience with Elastic Stack (Elasticsearch, Logstash, Kibana, and Elastic Security), including deployment, administration, or security monitoring use cases.
• Experience developing security detection content, correlation searches, and dashboards within Splunk.
• Familiarity with Splunk Enterprise Security (ES) and its security monitoring and incident investigation capabilities.
• Experience with log collection and pipeline technologies such as Splunk Universal Forwarder, Heavy…