Security Engineer: Incident Response & SIEM Tuning (Remote/On-site)

System One; Laurel (MD); Hybrid; USD 96,000 - 138,000; Full time

Benefits offered by this job

Health benefits

Dental coverage

Vision coverage

Life insurance

401(k) plan

Spending accounts

Voluntary plans

Job summary

System One is seeking an experienced Security Engineer for a 1099 contract position in the US. The role requires monitoring security systems, leading incident response, and refining detection capabilities within AWS GovCloud and FedRAMP/FISMA Moderate contexts.

You will collaborate across teams to track threats, implement secure SDLC practices, and maintain robust vulnerability management with a focus on reducing false positives.

Qualifications

• 5+ years of security engineering experience in FedRAMP or FISMA Moderate environments.
• Hands-on with UiPath architecture: Orchestrator, attended/unattended robots, assets and credential stores.
• Design and implementation of service accounts, credential vaulting, RBAC, separation of duties, and session/audit logging.

Responsibilities

• Monitor systems for abnormal activity; analyze alerts to identify threats.
• Lead incident response: containment, eradication, recovery, post-incident analysis.
• Refine alert thresholds; tune SIEM rules; integrate new data sources to reduce false positives.
• Produce weekly/monthly reports on incident trends, threat activity, and security posture.
• Participate in threat intel reviews and cross-departmental syncs.

Skills

FedRAMP/FISMA Moderate

AWS GovCloud

UiPath Orchestrator

RBAC/separation of duties

NIST SP 800-53 Rev 5

Vulnerability scanning

STIG/CIS hardening

Secure SDLC

Automation scripting

Tools

UiPath

AWS GovCloud tools

Job description

System One is seeking an experienced Security Engineer for a 1099 contract position in the US. The role requires monitoring security systems, leading incident response, and refining detection capabilities within AWS GovCloud and FedRAMP/FISMA Moderate contexts.

You will collaborate across teams to track threats, implement secure SDLC practices, and maintain robust vulnerability management with a focus on reducing false positives.