Senior SOC Engineer: SIEM, Detection & IR (Onsite)

Amentum company; Ellicott City (MD); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

Health insurance

401(k) matching

Paid time off

Educational reimbursement

Parental leave

Employee stock purchase plan

Tax-saving options

Disability and life insurance

Pet insurance

Job summary

Amentum is seeking a skilled SOC Engineer to design, deploy, and enhance enterprise SOC capabilities across complex environments. You will work with security analysts, admins, and engineers to improve threat visibility and response effectiveness.

The role requires hands-on SIEM engineering, log management, and incident response in potentially classified settings, with opportunities for advanced automation and playbook development.

Qualifications

• 6+ years of experience supporting SOC, cybersecurity engineering, SIEM engineering, or ISSE.
• Experience deploying and maintaining Splunk Enterprise Security and/or other enterprise SIEM platforms.
• Strong understanding of security event management, log management, and threat detection methodologies.
• Experience developing SIEM correlation searches, analytic rules, dashboards, and detection use cases.
• Experience supporting cybersecurity operations within classified or highly regulated environments.
• Strong knowledge of Windows and Linux operating systems, including admin and troubleshooting.
• Experience with scripting or automation using PowerShell, Python, Bash, or similar languages.
• Experience working within virtualized and containerized environments.
• Understanding of MITRE ATT&CK and cyber kill chain methodologies.
• Knowledge of incident response, digital forensics, threat hunting, and malware analysis principles.

Responsibilities

• Design, implement, configure, and maintain SIEM, log management, and security monitoring solutions.
• Evaluate SOC architectures and recommend improvements for scalability and threat visibility.
• Engineer and optimize log collection pipelines across network, system, and cloud environments.
• Develop and maintain detection content, including correlation searches and alerts.
• Identify gaps in detection coverage and implement threat intelligence aligned solutions.
• Create and maintain SOC playbooks, SOPs, and incident response workflows.
• Support investigations through log, endpoint, malware analysis and forensic data collection.
• Design security automation to reduce analyst workload and improve response times.
• Develop metrics, dashboards, and reporting for SOC performance and health.
• Participate in threat hunting and malware analysis activities.
• Author scripts and automation tools to improve SOC efficiency.

Skills

SOC experience

Splunk ES

SIEM engineering

Windows

Linux

PowerShell

Python

Bash

Threat detection

Incident response

Education

High School Diploma or equivalent

Bachelor's Degree in IT/CS/Engineering

Tools

Splunk

Docker

Podman

Elastic Stack

Job description

Amentum is seeking a skilled SOC Engineer to design, deploy, and enhance enterprise SOC capabilities across complex environments. You will work with security analysts, admins, and engineers to improve threat visibility and response effectiveness.

The role requires hands-on SIEM engineering, log management, and incident response in potentially classified settings, with opportunities for advanced automation and playbook development.