TS/SCI Cloud Security Engineer — AWS, SIEM & Incident Response

ManTech; Illinois; On-site; USD 142,000 - 236,000; Full time

Benefits offered by this job

Health Insurance

Paid Time Off

Holiday Pay

Disability Insurance

Retirement and Savings

Job summary

MANTECH is seeking a highly technical Cloud Security Engineer to join our team in Herndon, VA, focusing on enhancing the customer’s cloud incident response posture. The candidate will bring strong AWS and SIEM expertise, plus scripting and automation skills.

Responsibilities include developing detection rules in Splunk, automation of incident response, and collaboration with CSOC to improve enterprise security. Active TS/SCI w/ Polygraph is required.

Qualifications

• 7+ years of experience with cloud security, cloud engineering or cyber operations.
• 7+ years of experience with Operating Systems, Network Infrastructure, Security Principles or System Architecture.
• 5+ years of experience with AWS.
• 3+ years of experience coding and scripting in Python.

Responsibilities

• Design, architecture and implementation of cloud security monitoring systems at enterprise scale.
• Develop and maintain scripts and automation tools using Python or similar languages.
• Design and implement automated incident response playbooks to streamline CSOC processes.
• Collaborate with CSOC team members, provide mentorship, plan cyber exercises and train staff.
• Stay current on cybersecurity trends and technologies; identify opportunities for process improvement.

Skills

Cloud security

Operating systems & networking

AWS

Python scripting

SIEM

Splunk

Education

Bachelor's degree in Computer Science / IT or related field

Tools

Splunk

SOAR platforms

Azure

Job description

MANTECH is seeking a highly technical Cloud Security Engineer to join our team in Herndon, VA, focusing on enhancing the customer’s cloud incident response posture. The candidate will bring strong AWS and SIEM expertise, plus scripting and automation skills.

Responsibilities include developing detection rules in Splunk, automation of incident response, and collaboration with CSOC to improve enterprise security. Active TS/SCI w/ Polygraph is required.