CYBERSECURITY ENGINEER (4)

Confidential; Columbus (OH); On-site; USD 90,000 - 150,000; Full time

Job summary

Confidential, a defense IT contractor, seeks a senior cybersecurity professional to perform advanced tasks on SIEM and threat analytics. You will analyze security requirements, design and maintain Splunk ES deployments, and develop dashboards and data monitors to elevate threats to incident responders in line with CERT IH and IAM roles.

Positions are in Columbus, OH and Richmond, VA; require seven years of IT experience, DOD Secret clearance, and proficiency with Linux and Splunk Core/ES.

Qualifications

• Seven (7) years of IT experience.
• DOD Secret Clearance and IT-1 Critical Sensitive or Tier 5 at proposal submission.
• Experience creating custom dashboards and reports in Splunk using threat data.
• Experience in integration and sustainment of Splunk Core and Splunk Enterprise Security (ES).

Responsibilities

• Develop ES rules, reports, dashboards, data monitors, active channels, trends and use cases to identify threats.
• Plan, install, configure, troubleshoot, maintain and backup Splunk components in DLA ELM architecture.
• Provide security engineering support for planning, design, development, testing and integration of information systems.

Skills

Threat analysis

Splunk ES

Splunk

Incident response

Dashboards

Tools

Splunk Core

Splunk ES

Linux

Job description

Performs a variety of routine project tasks applied to specialized cybersecurity problems. Tasks involve integration of electronic processes or methodologies to resolve total system problems, or technology problems as they relate to cybersecurity requirements. Analyzes information security requirements. Applies analytical and systematic approaches in the resolution of problems of workflow, organization, and planning. Provides security engineering support for planning, design, development, testing, demonstration, integration of information systems. Analyzes threat information gathered from logs, Intrusion Detection Systems (IDS), intelligence reports, vendor sites, and a variety of other sources. Creates customized dashboards using Security Information and Event Management (SIEM) tool Splunk ES to elevate high threat items to incident responders. Administration knowledge of the Splunk ES and backend database infrastructure related to upgrades and daily maintenance is essential.

Provide analysis and make recommendations in line with the roles of CERT Incident Handlers (IH) and site Information Assurance Managers (IAM). Develop ES rules, reports, dashboards, data monitors, active channels, trends and use cases to identify threats and optimize data mining across DLA. Will research, plan, install, configure, troubleshoot, maintain and backup all components in the DLA Splunk Enterprise Log Management (ELM) architecture.

Minimum Experience:

• Seven (7) years of relevant IT experience
• DOD Secret Clearance
• Must possess IT-I Critical Sensitive security clearance or Tier 5 (T5) at time of proposal submission
• Primary DCWF Work Role 521: Cyber Defense Infrastructure Support- Proficiency Level: Intermediate
• Secondary DCWF Work Role 451: System Administrator- Proficiency Level: Intermediate
• Computing Environment: Linux+, Splunk Administrator
• Experience creating custom dashboards and reports in Splunk using threat data
• Experience in the integration and sustainment of Splunk Core and Splunk Enterprise Security (ES).

Positions are available in Columbus, OH and Richmond, VA