Senior Cybersecurity Engineer - SIEM/EDR Lead

General Dynamics Information Technology; Bossier City (LA); Hybrid; USD 140,000 - 190,000; Full time

Job summary

General Dynamics Information Technology in the United States is seeking a Cybersecurity Engineer Principal to join a senior technical role in the SOC. You will own design, implementation, and automation of the SIEM ecosystem, serve as SME for Windows/Linux, EDR, and vulnerability management, and drive detection content, playbooks, and threat intelligence across a multi-customer federal environment.

The role requires deep expertise across SIEM, SOAR, EDR, and vulnerability management with strong

Qualifications

• BA/BS or equivalent and 8+ years of progressive cybersecurity, SOC, or security engineering experience.
• 5+ years administering and securing Windows and Linux systems including Active Directory, IAM, PKI, baseline hardening, patching, and automation.
• Hands-on SIEM engineering experience including architecture design, data onboarding, parsing and normalization, detection development, dashboards, and performance optimization.
• Strong experience with Splunk—including SPL development, Enterprise Security, and API integrations—with exposure to additional SIEM platforms such as Microsoft Sentinel or IBM QRadar.
• SOAR engineering experience including API-driven automated workflows, enrichment, containment, response playbooks, and scripting for automation.
• Enterprise EDR administration with direct experience in CrowdStrike Falcon, including sensor deployment, policy tuning, custom IOAs, behavioral detections, threat hunting, and incident response support; experience with Defender for Endpoint or SentinelOne also applicable.
• Vulnerability and compliance management experience using Qualys or equivalent tools (Tenable, Rapid7), aligned to NIST 800-53, FISMA, DISA STIGs, and CIS Benchmarks.
• Cloud security monitoring experience across AWS, Azure, or GCP including cloud log ingestion and detection engineering.
• Identity and PAM telemetry correlation experience with Active Directory, Okta, or CyberArk integrated into SIEM and SOAR pipelines.
• Network monitoring experience including IDS/IPS analysis, NetFlow analytics, and east-west traffic visibility.
• Strong scripting proficiency in Python and PowerShell/Bash for automation and platform integration.
• Experience developing detection content aligned to MITRE ATT&CK and performing coverage gap analysis.
• Ability to integrate and automate security platforms using REST APIs, SDKs, and event-driven pipelines.
• Strong communication skills and proven ability to interface effectively with technical teams, executives, and customer stakeholders.

Responsibilities

• Administer, harden, and automate Windows Server and Linux systems; manage Active Directory, IAM, and PKI; apply secure configuration and patch baselines.
• Design, implement, and operate distributed SIEM architectures and data onboarding pipelines.
• Develop high-fidelity SIEM detection content, dashboards, and alarms; optimize retention and indexing strategies.
• Build and maintain SOAR workflows including playbooks for triage, enrichment, and containment.
• Administer and optimize enterprise EDR platforms; map detections to MITRE ATT&CK; support incident response.
• Lead vulnerability and compliance programs aligned to NIST/DISA CIS benchmarks; automate remediation.
• Lead detection engineering and threat intel operations; maintain version control and test pipelines.
• Maintain platform operations, monitoring, upgrades, and runbooks; serve as Tier III escalation for SIEM/SOAR/EDR.
• Collaborate across analysts, engineering, and customer stakeholders; mentor engineers; present findings to executives.

Skills

Windows administration

Linux administration

SIEM engineering

SOAR automation

EDR administration

Vulnerability management

Cloud security

Identity and PAM telemetry

Network monitoring

Scripting Python

PowerShell/Bash scripting

MITRE ATT&CK mapping

REST APIs integration

Education

Bachelor's degree or equivalent

Tools

Splunk

CrowdStrike Falcon

Defender for Endpoint

SentinelOne

Qualys

Tenable

Rapid7

Job description

General Dynamics Information Technology in the United States is seeking a Cybersecurity Engineer Principal to join a senior technical role in the SOC. You will own design, implementation, and automation of the SIEM ecosystem, serve as SME for Windows/Linux, EDR, and vulnerability management, and drive detection content, playbooks, and threat intelligence across a multi-customer federal environment.

The role requires deep expertise across SIEM, SOAR, EDR, and vulnerability management with strong