Blue Team Infrastructure Lead — SIEM, Cloud & ZTA

Peraton; Arlington (VA); On-site; USD 86,000 - 138,000; Full time

Job summary

Peraton is seeking a Blue Team Senior Engineer / Infrastructure SME to support the DoS DSCM program. Location is Rosslyn, VA, with responsibilities spanning enterprise system assessment, remediation coordination, and cross-team collaboration.

The role requires advanced security certifications, experience with Splunk, Tanium, Defender for Endpoint, and ServiceNow SOAR, and a strong understanding of cloud security (Azure/AWS).

Qualifications

• Bachelor's degree with 5 years of exp; 3 years with a Masters; 0 with PhD; 4 extra years may substitute.
• CISSP-ISSAP, CISSP-ISSEP, CISSP, Security+ CE, CySA+ and related certs preferred.
• Proficiency in Splunk and SOAR platforms; strong endpoint protection tools.

Responsibilities

• Assist with enterprise efforts to assess systems and provide technical recommendations.
• Coordinate remediation of findings with relevant teams.
• Leverage SIEM/SOAR to track exposures and drive remediation.
• Ensure security of on-prem and cloud IaaS, PaaS, SaaS environments.
• Communicate cybersecurity recommendations to system owners and verify remediation.
• Develop and test new tools for findings applicability and reduce false positives.
• Apply a zero-trust architecture to all system types including cloud and on-prem.

Skills

Zero-trust

Cloud security

SIEM

SOAR

Education

Bachelor's degree in IT or related field

CISSP-ISSAP

CISSP

CISSP-ISSEP

Security+ CE

CySA+

SNOW App Dev

Agile IC

Top Secret eligibility

Active Secret clearance

Tools

Splunk

Tanium

Microsoft Defender for Endpoint

ServiceNow SOAR

Azure Security Center

AWS Security Hub

Kusto Query Language (KQL)

Job description

Peraton is seeking a Blue Team Senior Engineer / Infrastructure SME to support the DoS DSCM program. Location is Rosslyn, VA, with responsibilities spanning enterprise system assessment, remediation coordination, and cross-team collaboration.

The role requires advanced security certifications, experience with Splunk, Tanium, Defender for Endpoint, and ServiceNow SOAR, and a strong understanding of cloud security (Azure/AWS).