On-Site Cyber Defense Engineer (TS/SCI) IDS/IPS Expert

DAn Solutions, Inc; Washington (District of Columbia); On-site; USD 140,000 - 190,000; Full time

Job summary

DAn Solutions, Inc. is seeking an experienced Network Intrusion Detection Engineer to design, deploy, and maintain IDS/IPS across a large enterprise.

The role focuses on Linux engineering, YAML configuration management, and integration with SIEM systems on Red Hat Enterprise Linux. Ideal candidates will have hands-on Suricata/Snort/Corelight experience, NIC tuning, and DoD 8570/IAT II certifications, with the ability to obtain polygraph clearance.

Qualifications

• Must hold TS/SCI clearance with ability to obtain counter-intelligence polygraph.
• Experience with Snort, Suricata or Corelight and managing YAML configurations.
• Extensive Red Hat Enterprise Linux (RHEL) administration and SE-Linux knowledge.
• Experience tuning Suricata with NICs and high-performance packet capture.
• Proficiency with scripting in Bash, Python, and Ansible for automation.
• DoD 8570 IAT Level II Certification or equivalent certifications.
• Ability to obtain DoD 8570 CSP/I3P certifications within 60 days of start.

Responsibilities

• Design, deploy, and maintain IDS/IPS across a large enterprise network.
• Develop, review, and optimize YAML configuration files for detection capabilities.
• Manage interaction between YAML and runtime engine: rule loading, logging, and decoding.
• Tune IDS/IPS performance with NICs, DMA, RSS, and interrupt coalescing.
• Collaborate with security teams to integrate with SIEM and monitoring platforms.
• Troubleshoot IDS/IPS on RHEL, including kernel modules and SE-Linux.
• Identify deployment pitfalls in large environments and mitigate them.
• Provide runbooks and documentation for Suricata configuration and deployment.
• Stay current with IDS/IPS software releases and NIC driver updates.

Skills

Network IDS/IPS systems

Linux engineering

YAML configuration understanding

Scripting: Bash, Python

DoD 8570 IAT Level II Certification

Education

Associate's degree with 5+ years IT experience

Bachelor's degree with 3+ years IT experience

Master's degree with 1+ year IT experience

Tools

Suricata

Snort

Corelight

YAML

Ansible

Docker

Kubernetes

Splunk

RHEL kernel modules

Job description

DAn Solutions, Inc. is seeking an experienced Network Intrusion Detection Engineer to design, deploy, and maintain IDS/IPS across a large enterprise.

The role focuses on Linux engineering, YAML configuration management, and integration with SIEM systems on Red Hat Enterprise Linux. Ideal candidates will have hands-on Suricata/Snort/Corelight experience, NIC tuning, and DoD 8570/IAT II certifications, with the ability to obtain polygraph clearance.