Principal Cyber Security Engineer

MANTECH; Chantilly (VA); On-site; USD 120,000 - 170,000; Full time

Job summary

MANTECH in Chantilly, VA seeks a Principal Cyber Security Engineer to design, deploy, and maintain secure data collection and monitoring solutions that enable informed decision-making across the enterprise. You will support mission-critical cybersecurity operations and ensure data integrity and rapid incident response.

The role requires strong SIEM expertise (Splunk), Linux administration, and DoD security guidance knowledge.

Qualifications

• Bachelor’s degree or equivalent cybersecurity experience.
• 7+ years of cybersecurity experience.
• Experience with SIEM platforms and Splunk enterprise environments.
• Knowledge of Linux systems administration, OS security, TCP/IP networking.
• Knowledge of Certification and Accreditation (C&A) processes and DoD security guidance.
• DoD 8570.1 IAT Level II+ certification, or ability to obtain within 30 days of hire.

Responsibilities

• Troubleshoot data collection issues to ensure reliable ingestion of security data.
• Diagnose and resolve system issues affecting stability, performance, or usability.
• Deploy, manage, and maintain Splunk Add-ons for data sources.
• Develop and maintain documentation, including BOE artifacts, engineering docs, change records, system security plans, and accreditation materials.
• Deliver Splunk deployment documentation detailing specifications, deployment methods, and architectural considerations for production environments.
• Implement and maintain strict RBAC to ensure data access on a need-to-know basis.
• Design and deploy Splunk forwarders using the Splunk Deployment Server for rapid, consistent deployments.

Skills

SIEM experience

Splunk expertise

Linux administration

Networking (TCP/IP)

DoD 8570.1 IAT II+

Education

Bachelor’s degree or equivalent cybersecurity experience

Tools

Splunk Enterprise

Splunk Deployment Server

AWS

Job description

MANTECH seeks a motivated, career and customer-oriented Principal Cyber Security Engineer to join our team in Chantilly, VA.

In this role, you will support mission-critical cybersecurity operations by designing, deploying, and maintaining secure, resilient data collection and monitoring solutions that enable informed decision-making across the enterprise.

Responsibilities include but are not limited to:

• Troubleshoot new and existing data collection issues to ensure accurate and reliable ingestion of security-relevant data.
• Diagnose and resolve system issues that impact stability, performance, or usability.
• Deploy, manage, and maintain supported and unsupported Splunk Add-ons required for specific data sources.
• Develop and maintain documentation, including Body of Evidence (BOE) artifacts, engineering documentation, change management records, system security plans, and accreditation materials.
• Deliver comprehensive Splunk deployment documentation detailing specifications, deployment methods, and architectural considerations for production environments.
• Implement and maintain strict role-based access control to ensure data is accessible on a validated need-to-know basis.
• Design and deploy Splunk forwarders using centralized configuration management through the Splunk Deployment Server to support rapid and consistent deployments.

Minimum Qualifications:

• Bachelor’s degree, or 4+ additional years of cybersecurity experience in lieu of a degree.
• 7+ years of experience in a cybersecurity role.
• Experience with Security Information and Event Management (SIEM) platforms and Splunk enterprise environments.
• Knowledge of Linux systems administration, general operating system security practices, TCP/IP networking, and network security concepts.
• Knowledge of Certification and Accreditation (C&A) processes and DoD technical security guidance for information systems.
• DoD Directive 8570.1 IAT Level II or higher certification, or the ability to obtain within 30 days of hire.

Preferred Qualifications:

• Hands-on experience with Linux distributions, including Red Hat and CentOS, and cloud environments such as AWS.
• Knowledge of IC 500-27 audit collection requirements and feed creation to ingest customer logs in standardized formats.
• Familiarity with Enterprise Security Services, Host Based Security Services (HBSS), Enterprise Vulnerability Scanning Services, and User Activity Monitoring (UAM).

Clearance Requirements:

• An active TS/SCI with Polygraph is required.

Physical Requirements:

• Must be able to remain in a stationary position 50% of the time.
• Needs to occasionally move about inside the office to access file cabinets, office machinery, etc.
• Frequently communicates with co-workers, management, and customers, which may involve delivering presentations. Must be able to exchange accurate information in these situations.