Cybersecurity Security Engineer

SOSi; Hawaii; On-site; USD 125,000 - 168,000; Full time

Job summary

SOSI is hiring a Cyber Security Engineer to architect and evolve the security ecosystem for a DoD Command and Control enterprise that supports thousands of users across the INDOPACOM theater. You will integrate SIEM, SOAR, and Linux automation to deliver actionable telemetry and automated security outcomes.

You will design detections aligned to MITRE ATT&CK, build dashboards, and support DoD RMF and STIG compliance.

Qualifications

• Bachelor's degree in Cyber Security, Computer Science, Information Systems, Computer Engineering or a related field.
• 3+ years hands-on engineering experience with SIEM/SOAR/EDR or equivalent security data pipelines.
• DoD 8570 IAT-II compliant security certifications (e.g., Security+, CCNA, CySA+, GICSP, GSEC, SSCP).
• Strong scripting or automation in Python/PowerShell/Bash/Ansible with REST API integrations.
• Experience implementing Zero Trust architectures and RMF/SCAP compliance in DoD environments.

Responsibilities

• Architect and evolve the security ecosystem supporting a DoD C2 enterprise across 5,000+ users.
• Integrate SIEM, SOAR, and Linux automation to deliver telemetry, automated outcomes, and real-time risk visibility.
• Develop detections and dashboards mapped to MITRE ATT&CK; reduce false positives with SOC.
• Design and maintain Zero Trust capabilities and DoD Reference Architecture alignment.
• Collaborate with SOC, engineers and government leaders to drive cyber resilience.

Skills

SIEM expertise

SOAR experience

Linux/Windows administration

Scripting (Python/PowerShell/Bash/AnsI

Communication to leadership

Education

Bachelor's degree in Cyber Security or related field

Tools

Elastic SIEM

SOAR platform

EDR

Vulnerability management (ACAS)

Linux configuration management

Job description

• Compensation: USD 124,512 - USD 168,091 - yearly

Company Description

Founded in 1989 and headquartered in Reston, Virginia, SOSi is a private defense and government solutions business specializing in advanced technology systems and mission support. Its capabilities include data science, software development, network engineering, intelligence, surveillance, and reconnaissance (ISR), and logistics.

Job Description

Shape the future of Zero Trust cybersecurity across the Pacific.

SOSi is seeking a Cyber Security Engineer to architect, integrate, and evolve the security ecosystem supporting a mission-critical Command and Control (C2) enterprise serving more than 5,000 users across the INDOPACOM theater. You'll unite SIEM, SOAR, and Linux automation technologies into a streamlined, intelligence-driven platform that delivers actionable telemetry, automated security outcomes, and real-time risk visibility. Working alongside engineers, SOC operators, and senior government leaders, you'll help drive the next generation of cyber resilience and Zero Trust operations.

At SOSi, we tackle complex technical challenges head-on—because Challenge Accepted isn’t just a motto, it’s how we operate

Zero Trust engineering

• Assess, design and maintain the roadmap for security capabilities aligned to the DoD Zero Trust Reference Architecture and Target-level activities across all seven pillars.
• Translate Zero Trust requirements into concrete configurations, segmentation rules and policies, and document how each control maps to the architecture.
• Evaluate, pilot and integrate new security technologies to close Zero Trust capability gaps.

SIEM, telemetry and analytics

• Design, deploy and tune SIEM Security, including Agent policies, integrations, index lifecycle management, data tiers and cluster sizing.
• Engineer security data pipelines that collect, filter, enrich and normalize data to a Common Schema before it reaches the SIEM, controlling volume and cost.
• Develop, test and tune detection rules, dashboards and alerts mapped to MITRE ATT&CK, reducing false positives in partnership with the SOC.

Security orchestration, automation and response (SOAR)

• Design, deploy and maintain the SOAR platform and its integrations with the SIEM, endpoint, vulnerability, identity, network and ticketing systems.
• Build and test playbooks for alert triage, enrichment, containment (e.g., isolating hosts, disabling accounts) and case management, with human approval gates where required.
• Support the Automation and Orchestration pillar of the DoD Zero Trust strategy, including policy decision and enforcement integration.
• Engineer and harden enterprise endpoint protection and EDR platforms, including DoD-mandated endpoint security solutions, covering policy, host intrusion prevention and device control.
• Maintain agent health, deployment coverage and policy compliance across Windows and Linux endpoints, and forward endpoint telemetry into the SIEM.

Vulnerability management

• Operate and optimize enterprise vulnerability scanning in line with DoD requirements (e.g., ACAS), including credentialed scan design, scan zones and reporting.
• Drive remediation by correlating findings with asset owners and patch status, tracking IAVM compliance and producing risk-based remediation priorities.

Linux engineering and compliance

• Engineer, build and maintain the enterprise Linux server infrastructure, including standard hardened builds, identity integration, performance and availability, upgrades and lifecycle replacement
• Engineer Linux content lifecycle, patching and errata workflows to deliver timely, tested updates across environments.
• Automate STIG and SCAP compliance with configuration-as-code, and report compliance status to leadership.

Compliance, risk and reporting

• Implement and validate STIGs and SRGs, and produce RMF artifacts, POA&Ms and evidence for assessments and inspections (e.g., CORA).
• Interact with vendors, other agencies and coalition partners on behalf of the program.
• Contribute to After Action Reports (AARs) and submit Weekly Activity Reports (WARs) in accordance with contract requirements.

Qualifications

• Active, in-scope Top Secret clearance with SCI eligibility, and a valid US passport.
• Bachelor's degree in Cyber Security, Computer Science, Information Systems, Computer Engineering or a related field and 5+ years of experienceOR9+ years of cybersecurity engineering experience in DoD or classified environment.
• 3+ years hands-on engineering (deploying, tuning and integrating, not only operating) with at least three of: SIEM (Elastic preferred), SOAR, security data pipelines, EDR, enterprise vulnerability management, and Linux configuration and patch management.
• DoD 8570 IAT-II compliant (Security+ CE, CCNA, CND, CySA+, GICSP, GSEC, or SSCP).
• Working knowledge of Zero Trust concepts, the DoD Zero Trust Reference Architecture, and tiered or privileged access models.
• Solid administration skills in Linux and Windows Server, including Active Directory, Kerberos, PKI and DNS fundamentals.
• Experience implementing STIGs and SRGs, SCAP scanning and RMF documentation in DoD environments.
• Scripting or automation in at least one of Python, PowerShell, Bash or Ansible, including REST API integrations.
• Clear written and verbal communication, including the ability to brief technical topics to senior leadership.

Preferred qualifications

• Hands-on engineering experience across all the capability areas above, including building SOAR playbooks in production.
• Elastic certifications (Elastic Certified Engineer or Analyst) and vendor certifications for the SOAR, EDR, data pipeline or vulnerability management platforms in use.
• Red Hat certifications (RHCSA or RHCE), and experience with Linux identity management integrated with Active Directory trusts.
• Experience designing detections with MITRE ATT&CK and building SOC workflows and metrics.
• Experience with privileged access workstations (PAWs), tiered or ESAE-style administration, and phishing-resistant MFA (CAC/PIV).
• Familiarity with Data Centric Security, NSA CSfC capability packages and Cross Domain Solutions (CDS).
• Experience with virtualization and hyperconverged platforms from a security-hardening perspective.

Additional Information

• Working conditions are normal for an office environment.
• Mission operations supporting a 24/5 baseline with potential evening, overnight, weekend, exercise, contingency, and surge coverage based on contract and mission requirements.
• Fast paced, deadline-oriented environment.

Working at SOSi

All interested individuals will receive consideration and will not be discriminated against for any reason.

By clicking the link above or any third-party link within this posting, you are leaving this site and going to a third-party website where the third-party website's terms and privacy policy apply