Cyber Engineer Principal

SAIC; Reston (VA); Remote; USD 120,000 - 160,000; Full time

Job summary

SAIC is seeking a highly hands-on Principal Cyber Engineer who thrives on building, breaking, and learning. This role combines security research with real-world deployments, in Zero Trust, AI platforms, and data engineering for security telemetry.

Remote role, but candidates must live within commuting range of Reston, VA. Occasional travel to VA/DC spaces and proposal centers is expected; active Top Secret clearance with SCI eligibility is required.

Qualifications

• U.S. citizen with an active Top Secret clearance and SCI eligibility.
• Typically 8+ years hands-on cyber engineering, SOC/SIEM architecture, or equivalent at Senior Principal depth.
• Ability to drive a team and advise contract cyber leads.
• Experience in RMF, CMMC, ICD-705 and incident response in live spaces.
• Strong knowledge of Zero Trust, AI platforms and security telemetry data engineering.

Responsibilities

• Enter customer spaces on short cycle; learn stack and people quickly; leave usable artifacts.
• Drive cyber team when spaces are new, thin or stuck; hand back runnable solutions.
• Assess cyber programs against frameworks; recommend modernization, automation, and next steps.
• Work in Zero Trust, AI platform security, data engineering for security telemetry, and SIEM/SOC architecture.
• Tackle RMF, CMMC, ICD-705 in live environments; support incident response.

Skills

Zero Trust

AI platforms

Data engineering

SIEM

Splunk

RMF

CMMC

ICD-705

PowerShell

Bash

AWS CLI

Windows

Linux

IAM

CloudWatch

S3

GuardDuty

Education

Bachelor's degree and 9 years of experience

Master's degree and 7 years of experience

Tools

Splunk

AWS CLI

PowerShell

Bash

Windows

Linux

IAM

CloudTrail

GuardDuty

VPC

Job description

Description

SAIC has an opening for a highly hands-on, Principal Cyber Engineer who lives and breathes this work—the SME for SMEs. The ideal candidate is someone who experiments at home, maintains a personal mixed OS lab, and genuinely enjoys tinkering with new and opensource security tools, building and breaking environments to learn how things work. This role is well-suited to someone who genuinely enjoys exploring new security capabilities, testing ideas, coding up useful experiments/aides/queries/skills/scripts with AI, and learning emerging patterns in Zero Trust, cloud security, AI platforms, and security data engineering.

***This is a Remote role butcandidates must live within commuting range of Reston, VA. Work is primarily from home, but frequently in customer spaces in Virginia or D.C., at the proposal center in Reston, at the Air Force Business Group in Crystal City, or on occasional travel. Candidates must be able to travel occasionally on short notice to support internal and external customer needs.***

Assignments range from two-days to 50 percent time for nine months. Travel is occasional and usually short; some trips come on short notice; occasional trips can last up to six weeks, with longer trips planned in advance. Candidates must have an active Top Secret clearance, with SCI eligibility.

Responsibilities:

• Enter customer spaces on short cycle. Learn the stack and the people in days. Leave usable artifacts, not just a briefing deck
• If the space is new, thin, or stuck, drive the cyber team, then hand it back runnable. Consult contract cyber leads; do not replace them
• Assess cyber programs and customer environments against applicable cyber and security frameworks. Recommend solutions, modernization, automation, and next steps to mature the innovation space
• Work in Zero Trust, AI platform security, data engineering for security telemetry, and SIEM / SOC architecture and automation. Support growing efforts in AI governance and securing AI agents and tool gateways
• Apply RMF, CMMC, and ICD-705 in live spaces. Support incident response. Engineer and tune security and cloud architecture, endpoint platforms, DLP, IPS, and load-balancer / traffic paths
• Treat time-indexed data (what happened) and stateful data (what is true now) as complementary, and use platforms and vendor relationships so both exist and feed Zero Trust activity targets
• Troubleshoot with CLI first - Windows, Linux, security-tool CLIs, AWS Console and AWS CLI. Escalate with evidence
• Teach. Present white papers. Write job aids for new and old frameworks. Contribute technically to proposals

Qualifications

• Bachelor’s degree and 9 years of experience, or A Master’s degree and 7 years of experience
• U.S. citizen with an active Top Secret clearance and the ability to obtain SCI
• Must live within commuting range of Reston, VA. Work is primarily from home, with regular time in VA/D.C. customer spaces, the Reston proposal center, AF BG Crystal City, and occasional travel (some short notice)
• Current CompTIA Security+ CE or equivalent 8140 intermediate certification
• Typically 8+ years of hands-on cyber engineering, SOC / SIEM architecture, enablement, or equivalent at Senior Principal depth. Must be able to drive a team and advise a contract cyber lead
• Experience assessing cyber programs and environments against cyber and security frameworks, then recommending solutions, modernization, and automation. Proven work in customer spaces, including mixed classification, on a support-request cadence. Occasional travel; some short notice
• Technical depth in Zero Trust and AI platforms; data engineering applied to security telemetry; SIEM automation or SOC tooling and architecture. Splunk experience strongly preferred
• Working familiarity within RMF, CMMC, ICD-705, incident response, security architecture, cloud security architecture, endpoint security platforms, DLP, IPS, and load balancers
• Can clearly explain time-indexed vs. stateful data, why a security environment needs both, and how tooling and vendors provide both for Zero Trust activity targets
• Strong troubleshooting skills. Current CLI on Windows and Linux (PowerShell, Bash or equivalent). Hands-on AWS Console and AWS CLI (IAM, CloudTrail, GuardDuty, Security Hub, VPC / flow logs, S3, CloudWatch or equivalent)
• Communicates and teaches cleanly. Writes job aids and presents to mixed audiences (technical and non-technical)

Desired Qualifications

• Current SCI; TS/SCI with Poly is a plus for the high end of the Service Delivery customers
  • Splunk Certified Admin, higher, or equivelant for security data engineering knowledge and experience yet not biased to any one tool. (Splunk, elastic, sentinal, etc…)
  • CISSP or higher (ISSAP, ISSEP, or ISSMP) to cover GRC related assignments
  • Additional current credentials in cloud, detection, architecture, or data (CCSP, CISM, GIAC, AWS / Azure security, CySA+ / CASP+, or equivalent)
  • Proposal / capture technical consulting; published or internal white papers; prior enablement of mixed-skill cyber teams.
  • Budding interest in AI governance and in securing AI agents and tool gateways
  • Experience with SOAR, EDR / XDR, identity platforms, security data lakes, and securing AI / ML platforms (Azure OpenAI, Bedrock, on-prem model hosting, RAG / LLMOps controls)

Target salary range: $120,001 - $160,000. The estimate displayed represents the typical salary range for this position based on experience and other factors.