Senior On-Prem NDR & SOC Integration Engineer

Booz Allen Hamilton; Charlottesville (VA); On-site; USD 99,000 - 225,000; Full time

Job summary

Booz Allen Hamilton is seeking an experienced VectraAI Integration Engineer to deploy, tune, and sustain sensors and pipelines in on‑prem environments. The role emphasizes network metadata, packet telemetry, routing, and integration with SOC tooling.

You will work with Zeek, Suricata, Arkime, and Endace, ensuring secure baselines, precise sensor placement, and reliable telemetry ingestion. TS/SCI with polygraph is required or willingness to obtain clearance.

Qualifications

• 7+ years of on‑premise network engineering or cybersecurity platform experience.
• Experience deploying NDR platforms in data center environments.
• Experience with packet analytics tools such as Zeek, Suricata, Arkime, or Endace.
• Experience with hardened OS builds, secure enclaves, access controls, and segmentation.
• Experience with Linux engineering and system operations.
• Ability to obtain DoD 8570 IAT Level III Certification within 30 days of start date.
• Ability to obtain CSSP-IS Certification within 30 days of start date.

Responsibilities

• Deploy and sustain VectraAI sensors, collectors, and metadata pipelines in on‑prem networks.
• Integrate VectraAI with on‑prem SIEM, SOAR, or EDR and packet brokers.
• Engineer sensor placement, SPANs, taps, and east‑west visibility.
• Manage routing, VLANs, packet capture, and metadata transformation.
• Support STIG‑aligned configurations and secure baselines.
• Build monitoring dashboards and health checks; tune performance workflows.
• Coordinate with operations teams for reliable telemetry ingestion and detection fidelity.

Skills

Network engineering

NDR deployment

Linux engineering

Security clearance TS/SCI

Packet analysis tools

Education

Associate’s degree + 10+ years IT

Bachelor’s degree + 8+ years IT

Master’s degree + 6+ years IT

Tools

Zeek

Suricata

Arkime

Endace

Job description

Booz Allen Hamilton is seeking an experienced VectraAI Integration Engineer to deploy, tune, and sustain sensors and pipelines in on‑prem environments. The role emphasizes network metadata, packet telemetry, routing, and integration with SOC tooling.

You will work with Zeek, Suricata, Arkime, and Endace, ensuring secure baselines, precise sensor placement, and reliable telemetry ingestion. TS/SCI with polygraph is required or willingness to obtain clearance.