Cybersecurity Engineer

State of Georgia; United States; Remote; USD 77,000 - 110,000; Full time

Job summary

The State of Georgia’s Department of Early Care and Learning seeks a Cybersecurity Engineer to lead Security Operations Engineering and cybersecurity monitoring for DECAL. You will mentor the team, enhance threat detection, and drive continuous improvement across security platforms.

Collaborating with Governance, Risk and Compliance, Legal, IT Operations and business units, you will elevate security visibility and incident response readiness in a remote-capable environment.

Qualifications

• We are seeking a skilled Cybersecurity Engineer to lead Security Operations Engineering and cybersecurity monitoring technologies.

Responsibilities

• Lead administration and continuous improvement of security operations platforms and services.
• Engineer and maintain security monitoring, threat detection, automation, and response capabilities.
• Configure and optimize data sources, telemetry, security connectors, and monitoring integrations for DECAL Security Operations.
• Develop analytics rules, alerts, dashboards, and automation workflows to strengthen detection and response.
• Coordinate with stakeholders to improve security visibility, operational readiness, and maturity.

Job description

Explore a World of Opportunity with the State of Georgia! We are the force that drives Georgia! Georgia State Government is a large enterprise, composed of various agencies and entities with a common goal to improve the lives of Georgia's more than 10 million citizens! Join Team Georgia and impact lives everyday while receiving a robust benefits package designed for every stage of your career!

Job Title: Cybersecurity Engineer Agency: Department of Early Care and Learning Job Requisition ID: JR0000007759 Shift: Day (United States of America) Compensation Details: $76,821.60 - $110,000.00 Job Description: Salary: $76,821.60 - $110,000 Commensurate with experience and education. Job Code: ISP012 Pay Grade: P Location: Headquarters-Based, Atlanta, Ga (REMOTE)

Bright from the Start: Georgia Department of Early Care and Learning is responsible for meeting the child care and early education needs of Georgia's children and their families. It administers the nationally recognized Georgia's Pre-K Program, licenses child care centers and home-based child care, administers Georgia Childcare and Parent Services (CAPS), federal nutrition programs, and manages Quality Rated, Georgia's community-powered child care rating system. The department also houses the Head Start State Collaboration Office, distributes federal funding to enhance the quality and availability of child care, and works collaboratively with child care resource and referral agencies and organizations throughout Georgia to enhance early care and education.

Job Description: We are seeking a skilled and proactive Cybersecurity Engineer to serve as DECAL's lead technical resource for Security Operations Engineering and cybersecurity monitoring technologies. This position is responsible for the engineering, administration, and continuous improvement of DECAL's Security Operations capabilities, including security monitoring, threat detection, cybersecurity automation, incident response coordination, vulnerability and exposure management, and assigned security operations technologies.

The Cybersecurity Engineer provides technical leadership for Microsoft Sentinel, Microsoft Defender, detection engineering, threat hunting, vulnerability management, email security technologies, and cybersecurity incident response. The position partners with Governance, Risk and Compliance (GRC), Legal, Information Technology Operations, Application Development, and business stakeholders to improve security visibility, operational readiness, and cybersecurity maturity.

Job Duties

Security Operations Engineering Lead

• Security Operations Engineering Lead administration, configuration, optimization, and continuous improvement of security operations platforms and services.
• Engineer and maintain security monitoring, threat detection, automation, and response capabilities.
• Configure, maintain, and optimize security data sources, telemetry collection, security connectors, and monitoring integrations supporting DECAL Security Operations.
• Develop and optimize analytics rules, alerts, dashboards, workbooks, automation workflows, and response playbooks.
• Manage security telemetry collection, event correlation, and monitoring visibility across security and enterprise platforms.
• Develop scripting and automation solutions to improve operational efficiency, detection, and response.
• Continuously improve monitoring coverage, operational effectiveness, and Security Operations maturity.

Detection Engineering and Threat Hunting

• Develop, tune, and maintain threat detections, monitoring use cases, analytical content, and MITRE ATT&CK-aligned detection coverage.
• Conduct proactive threat hunting, Indicator of Compromise (IOC) analysis, and advanced security investigations.
• Analyze threat intelligence, attack techniques, and security events to identify emerging threats and improve detection effectiveness.
• Perform root cause analysis and incorporate lessons learned into monitoring and response capabilities.

Vulnerability and Exposure Management Lead

• Lead technical vulnerability and exposure management activities across the enterprise.
• Manage Microsoft Defender Vulnerability Management, Azure Secure Score, Defender for Cloud recommendations, exposure reduction, remediation tracking, and security posture reporting.
• Coordinate with infrastructure, application, and business teams to prioritize and address security findings and recommendations.
• Validate remediation and support implementation of technical recommendations and compensating controls.

Incident Response

• Serve as the technical lead and organizer for cybersecurity investigations and incident response activities.
• Coordinate technical response, evidence collection, containment, eradication, and recovery support.
• Maintain incident documentation, facilitate after-action reviews, and translate lessons learned into operational improvements.