Darktrace Engineer - Secret | Washington, DC

Optiv + Clear Shark is looking for a Darktrace Cybersecurity Engineer is responsible for the design, deployment, configuration, integration, tuning, and operational support of Darktrace Cyber AI capabilities across enterprise networks, endpoints, email, cloud, SaaS, identity, and other supported environments. The engineer will work closely with security operations, network engineering, cloud engineering, identity, incident response, and customer stakeholders to improve threat detection, investigation, and response.

This position requires a technically strong cybersecurity professional with experience in network detection and response, security monitoring, incident triage, packet and log analysis, security-tool integration, and operational security engineering. The successful candidate will be comfortable working in regulated or federal environments and will translate Darktrace detections, behavioral analytics, and AI-assisted investigations into actionable security outcomes. Darktrace capabilities may encompass network, endpoint, email, cloud, SaaS, and identity telemetry, with AI-assisted investigation workflows and integrations to SIEM, SOAR, EDR/XDR, cloud, and log-management technologies.###

** How you’ll make an impact
*** Design, deploy, configure, administer, and maintain Darktrace platform components within on-premises, hybrid-cloud, and cloud-hosted enterprise environments.
* Configure and tune Darktrace detections, behavioral models, alerting thresholds, autonomous-response policies, and investigative workflows to align with the organization’s threat model, risk tolerance, architecture, and security operations processes.
* Lead or support implementation of applicable Darktrace capabilities, including network, email, endpoint, cloud, SaaS, and identity-security use cases.
* Perform ongoing platform health checks, capacity planning, sensor or collector placement assessments, system upgrades, configuration validation, and technical troubleshooting.
* Analyze Darktrace model breaches, alerts, anomalies, incident investigations, device behavior, network traffic, and related security telemetry to identify malicious activity, suspicious behavior, false positives, and opportunities for tuning.
* Collaborate with SOC analysts, incident responders, threat hunters, network engineers, cloud teams, system administrators, and identity teams to investigate and contain security events.
* Develop and maintain use cases for threat detection, triage, investigation, enrichment, and escalation across enterprise security domains.
* Configure, test, and maintain integrations between Darktrace and enterprise security technologies, including SIEM, SOAR, EDR/XDR, ticketing, vulnerability-management, threat-intelligence, identity, cloud-security, and log-management platforms.
* Use APIs, syslog, webhooks, automation, and scripting to exchange security events, enrich detections, automate workflows, and support incident-response processes.
* Support security monitoring and incident-response activities by providing deep technical analysis of network, endpoint, email, cloud, SaaS, and identity-related telemetry.
* Develop standard operating procedures, implementation guides, architecture diagrams, operational runbooks, escalation procedures, and knowledge-base articles.
* Produce clear technical reports and briefings that describe detected activity, risk, root cause, response actions, platform health, tuning recommendations, and security trends.
* Participate in security architecture reviews and advise stakeholders on telemetry coverage, sensor placement, segmentation, visibility gaps, logging requirements, and detection strategy.
* Support validation of Darktrace response actions and ensure automated or…