Cyber Security Engineer

SOS International LLC; Hawaii; On-site; USD 125,000 - 168,000; Full time

Job summary

SOSi is seeking a Cyber Security Engineer at Joint Base Pearl Harbor Hickam to architect and evolve the security ecosystem for a 5,000+ user C2 enterprise across INDOPACOM. You will unify SIEM, SOAR, and Linux automation to deliver telemetry, automated outcomes, and real‑time risk visibility, in collaboration with SOC and government leaders.

Responsibilities include building a DoD‑aligned Zero Trust roadmap, implementing IAM, network segmentation, and incident response automation, while ensuring

Qualifications

• Active Top Secret clearance with SCI eligibility.
• Degree plus 5+ years in DoD or 9+ years in cybersecurity engineering.
• Hands-on with SIEM, SOAR, data pipelines, EDR, and patch management.
• DoD 8570 IAT-II compliant certifications.
• Zero Trust concepts and DoD architecture knowledge.
• Linux and Windows server administration (AD, Kerberos, PKI, DNS).
• Experience with STIGs, RMF docs, and SCAP scanning.
• Has scripting skills in Python/PowerShell/Bash/Ansible and REST APIs.
• Strong written and verbal briefing skills for leadership.

Responsibilities

• Design and road‑map security capabilities aligned to DoD Zero Trust.
• Translate requirements into concrete configurations and policies.
• Pilot and integrate new security tech to close gaps.
• Design, deploy and tune SIEM telemetry and analytics.
• Build data pipelines to a Common Schema for SIEM ingestion.
• Develop detection rules mapped to MITRE ATT&CK with SOC in mind.
• Design, deploy and maintain SOAR integrations and playbooks.
• Support DoD Zero Trust policy enforcement and DoD strategy.
• Engineer endpoint protection and vulnerability remediation.
• Produce RMF artifacts and assist in risk reporting.

Skills

Top Secret/SCI clearance

DoD cybersecurity engineering

SIEM

SOAR

Linux/Windows admin

Python/PowerShell/Bash

REST API integrations

Communication to leadership

Education

Bachelor's degree in Cyber Security/CS/IS/Engineering

5+ years DoD/classified cybersecurity

Tools

Elastic SIEM

EDR

Vulnerability management tools

Job description

Joint Base Pearl Harbor Hickam, HI, USA

Full-time

Clearance Requirement: Top Secret/SCI

Compensation: USD 124512 - USD 168091 - yearly

Company Description

Founded in 1989 and headquartered in Reston, Virginia, SOSi is a private defense and government solutions business specializing in advanced technology systems and mission support. Its capabilities include data science, software development, network engineering, intelligence, surveillance, and reconnaissance (ISR), and logistics.

Job Description

Shape the future of Zero Trust cybersecurity across the Pacific. ?

SOSi is seeking a Cyber Security Engineer to architect, integrate, and evolve the security ecosystem supporting a mission-critical Command and Control (C2) enterprise serving more than 5,000 users across the INDOPACOM theater. You'll unite SIEM, SOAR, and Linux automation technologies into a streamlined, intelligence-driven platform that delivers actionable telemetry, automated security outcomes, and real-time risk visibility. Working alongside engineers, SOC operators, and senior government leaders, you'll help drive the next generation of cyber resilience and Zero Trust operations.

? At SOSi, we tackle complex technical challenges head‑on—because Challenge Accepted isn’t just a motto, it’s how we operate?

Essential Job Duties:

Zero Trust engineering

• Assess, design and maintain the roadmap for security capabilities aligned to the DoD Zero Trust Reference Architecture and Target‑level activities across all seven pillars.
• Translate Zero Trust requirements into concrete configurations, segmentation rules and policies, and document how each control maps to the architecture.
• Evaluate, pilot and integrate new security technologies to close Zero Trust capability gaps.

SIEM, telemetry and analytics

• Design, deploy and tune SIEM Security, including Agent policies, integrations, index lifecycle management, data tiers and cluster sizing.
• Engineer security data pipelines that collect, filter, enrich and normalize data to a Common Schema before it reaches the SIEM, controlling volume and cost.
• Develop, test and tune detection rules, dashboards and alerts mapped to MITRE ATT&CK, reducing false positives in partnership with the SOC.

Security orchestration, automation and response (SOAR)

• Design, deploy and maintain the SOAR platform and its integrations with the SIEM, endpoint, vulnerability, identity, network and ticketing systems.
• Build and test playbooks for alert triage, enrichment, containment (e.g., isolating hosts, disabling accounts) and case management, with human approval gates where required.
• Support the Automation and Orchestration pillar of the DoD Zero Trust strategy, including policy decision and enforcement integration.

Endpoint security

• Engineer and harden enterprise endpoint protection and EDR platforms, including DoD‑mandated endpoint security solutions, covering policy, host intrusion prevention and device control.
• Maintain agent health, deployment coverage and policy compliance across Windows and Linux endpoints, and forward endpoint telemetry into the SIEM.

Vulnerability management

• Operate and optimize enterprise vulnerability scanning in line with DoD requirements (e.g., ACAS), including credentialed scan design, scan zones and reporting.
• Drive remediation by correlating findings with asset owners and patch status, tracking IAVM compliance and producing risk‑based remediation priorities.

Linux engineering and compliance

• Engineer, build and maintain the enterprise Linux server infrastructure, including standard hardened builds, identity integration, performance and availability, upgrades and lifecycle replacement
• Engineer Linux content lifecycle, patching and errata workflows to deliver timely, tested updates across environments.
• Automate STIG and SCAP compliance with configuration-as-code, and report compliance status to leadership.

Compliance, risk and reporting

• Implement and validate STIGs and SRGs, and produce RMF artifacts, POA&Ms and evidence for assessments and inspections (e.g., CORA).
• Interact with vendors, other agencies and coalition partners on behalf of the program.
• Contribute to After Action Reports (AARs) and submit Weekly Activity Reports (WARs) in accordance with contract requirements.

Qualifications

Minimum Requirements

• Active, in‑scope Top Secret clearance with SCI eligibility, and a valid US passport.
• Bachelor's degree in Cyber Security, Computer Science, Information Systems, Computer Engineering or a related field and 5+ years of experience OR 9+ years of cybersecurity engineering experience in DoD or classified environment.
• 3+ years hands‑on engineering (deploying, tuning and integrating, not only operating) with at least three of: SIEM (Elastic preferred), SOAR, security data pipelines, EDR, enterprise vulnerability management, and Linux configuration and patch management.
• DoD 8570 IAT-II compliant (Security+ CE, CCNA, CND, CySA+, GICSP, GSEC, or SSCP).
• Working knowledge of Zero Trust concepts, the DoD Zero Trust Reference Architecture, and tiered or privileged access models.
• Solid administration skills in Linux and Windows Server, including Active Directory, Kerberos, PKI and DNS fundamentals.
• Experience implementing STIGs and SRGs, SCAP scanning and RMF documentation in DoD environments.
• Scripting or automation in at least one of Python, PowerShell, Bash or Ansible, including REST API integrations.
• Clear written and verbal communication, including the ability to brief technical topics to senior leadership.

Preferred qualifications

• Hands‑on engineering experience across all the capability areas above, including building SOAR playbooks in production.
• Elastic certifications (Elastic Certified Engineer or Analyst) and vendor certifications for the SOAR, EDR, data pipeline or vulnerability management platforms in use.
• Red Hat certifications (RHCSA or RHCE), and experience with Linux identity management integrated with Active Directory trusts.
• Experience designing detections with MITRE ATT&CK and building SOC workflows and metrics.
• Experience with privileged access workstations (PAWs), tiered or ESAE‑style administration, and phishing‑resistant MFA (CAC/PIV).
• Familiarity with Data Centric Security, NSA CSfC capability packages and Cross Domain Solutions (CDS).
• Experience with virtualization and hyperconverged platforms from a security‑hardening perspective.

Additional Information

Work Environment

• Working conditions are normal for an office environment.
• Mission operations supporting a 24/5 baseline with potential evening, overnight, weekend, exercise, contingency, and surge coverage based on contract and mission requirements.
• Fast paced, deadline‑oriented environment.

Working at SOSi

All interested individuals will receive consideration and will not be discriminated against for any reason.

SOSi is an equal employment opportunity employer and affirmative action employer. All interested individuals will receive consideration and will not be discriminated against on the basis of race, color, religion, sex, national origin, disability, age, sexual orientation, gender identity, genetic information, or protected veteran status. SOSi takes affirmative action in support of its policy to advance diversity and inclusion of individuals who are minorities, women, protected veterans, and individuals with disabilities.