CYBERSECURITY ENGINEER 4 – SIEM / SPLUNK ENGINEER

iP-Plus Consulting, Inc.; Richmond (VA); On-site; USD 120,000 - 170,000; Full time

Job summary

iP-Plus Consulting, Inc. is seeking a Cybersecurity Engineer 4 to join our team onsite in Columbus, OH or Richmond, VA. The role focuses on cyber defense, incident response, and SIEM engineering using Splunk ES.

Candidates should have an active DOD Secret clearance and multiple security certifications listed in the requirements. The position emphasizes building dashboards, threat detection, and secure system administration.

Qualifications

• Seven (7) years of relevant IT experience.
• DOD Secret Clearance, IT-I/Critical Sensitive or Tier 5.
• 8140 Baseline Certification requirements as noted.
• One of the listed cybersecurity certifications (CEH, Cloud+, CySA+, PenTest+, SSCP, Security+, GSEC).
• Additional certifications from CompTIA and GIAC meet intermediate requirements.
• Experience creating dashboards and reports in Splunk using threat data.
• Experience with Splunk Core and Splunk Enterprise Security (ES).

Responsibilities

• Create customized dashboards using Splunk ES to elevate threats to incident responders.
• Provide analysis and make recommendations per CERT IH and IAM roles.
• Plan, install, configure, troubleshoot, maintain Splunk ELM architecture.
• Develop ES rules, reports, dashboards, data monitors, and use cases.

Education

DOD Secret Clearance

8140 Baseline Certification: Primary DCWF Work Role 521

8140 Baseline Certification: Primary DCWF Secondary DCWF Work Role 451

CEH

Cloud+

CySA+

PenTest+

SSCP

Security+

GSEC

CompTIA Security+

CompTIA Cloud+

GIAC Security Essentials (GSEC)

Linux+

Splunk Administrator

Splunk Administrator (Splunk ES)

Linux+

Tools

Splunk ES

Splunk Enterprise Security (ES)

SIEM

Splunk Administrator

Job description

Cybersecurity Engineer 4

Location: Onsite in Columbus, OH; or Richmond, VA

Security Clearance: Secret

Job Description

Cybersecurity Engineer 4 performs a variety of routine project tasks applied to specialized cybersecurity problems. Tasks involve integration of electronic processes or methodologies to resolve total system problems, or technology problems as they relate to cybersecurity requirements. Analyzes information security requirements. Applies analytical and systematic approaches in the resolution of problems of workflow, organization, and planning. Provides security engineering support for planning, design, development, testing, demonstration, integration of information systems. Analyzes threat information gathered from logs, Intrusion Detection Systems (IDS), intelligence reports, vendor sites, and a variety of other sources. Creates customized dashboards using Security Information and Event Management (SIEM) tool Splunk ES to elevate high threat items to incident responders.Administration knowledge of the Splunk ES and backend database infrastructure related to upgrades and daily maintenance is essential.Provide analysis and make recommendations in line with the roles of CERT Incident Handlers (IH) and site Information Assurance Managers (IAM). Develop ES rules, reports, dashboards, data monitors, active channels, trends and use cases to identify threats and optimize data mining across DLA. Will research, plan, install, configure, troubleshoot, maintain and backup all components in the DLA Splunk Enterprise Log Management (ELM) architecture.

Required Qualifications:

• Seven (7) years of relevant IT experience
• DOD Secret Clearance
• Must possess IT-I Critical Sensitive security clearance or Tier 5 (T5)
• 8140 Baseline Certification: Primary DCWF Work Role 521: Cyber Defense Infrastructure Support - Proficiency Level: Intermediate

Candidate must possess one of the following certifications:

• CEH, Cloud+, CySA+, PenTest+, SSCP, Security+, and GSEC

Note: higher or advanced GIAC or CISSP concentrations also satisfy the intermediate requirement

• 8140 Baseline Certification for Primary DCWF Secondary DCWF Work Role 451: System Administrator - Proficiency Level: Intermediate

Candidate must possess one the following certifications:

• CompTIA Security+, CompTIA Cloud+
• GIAC Security Essentials (GSEC)

• Computing Environment Certification: Linux+, Splunk Administrator
• Experience creating custom dashboards and reports in Splunk using threat data
• Experience in the integration and sustainment of Splunk Core and Splunk Enterprise Security (ES).