associate help desk technician - all shifts available - active top secret required

incident handler/security analyst - 3rd shift

intrusion detection team lead - 2nd shift

intrusion detection team lead - 3rd shift

associate help desk technician - all shifts available - active top secret required Jobs in Washington

cybersecurity operations engineer Jobs in Washington

cybersecurity operations engineer

incident handler/security analyst - 3rd shift Jobs in Washington

intrusion detection team lead - 2nd shift Jobs in Washington

intrusion detection team lead - 3rd shift Jobs in Washington

intrusion detection team lead 2nd shift

GovCIO

<div>Overview:
<div>
GovCIO is currently hiring for a <b>2nd shift (3pm - 11:30pm)</b> Master Level Cyber Defense Analyst/Intrusion Detection Team Shift Lead onsite in Washington, DC.</div>
Responsibilities:
<ul><li>Collaborates with intrusion analysts to identify, report on, and coordinate remediation of cyber threats to the client</li><li>
Provides timely and actionable sanitized intelligence to cyber incident response professionals</li><li>
Leverages technical knowledge of computer systems and networks with cyber threat information to assess the client's security posture</li><li>
Conducts intelligence analysis to assess intrusion signatures, tactics, techniques and procedures associated with preparation for and execution of cyber attacks</li><li>
Researches hackers, hacker techniques, vulnerabilities, exploits, and provides detailed briefings and intelligence reports to leadership</li></ul>
Qualifications:
<ul><li>Bachelor's with 8+ years of cyber security experience (or commensurate experience)</li><li>
7 years of security intrusion detection examination experience involving a range of security technologies that product logging data; to include wide area networks host and network IPS/IDS/HIPs traffic event review, server web log analysis, raw data logs</li><li>
Working experience of Splunk SIEM. Contractor will have at least two years as a cyber security or security operations shift team leader</li><li>
At least five years&rsquo; experience working at a senior level, performing analytics examination of logs and console events in the following working experience areas of; creating advance queries methods in Splunk or advance Grep skills, firewall ACL review, examining Snort based IDS events, Pcaps, web server log review, and working in a SIEM environment</li></ul><br>
<div></div>
Posted Salary Range: USD $108,310.00 - USD $150,000.00 /Yr.</div>

Intrusion Detection Team Lead - 2nd shift

<div>Overview:
<div>
GovCIO is currently hiring for a <b>3rd shift (11pm - 7:30am)</b> Master Level Cyber Defense Analyst/Intrusion Detection Team Shift Lead onsite in Washington, DC.</div>
Responsibilities:
<ul><li>Collaborates with intrusion analysts to identify, report on, and coordinate remediation of cyber threats to the client</li><li>
Provides timely and actionable sanitized intelligence to cyber incident response professionals</li><li>
Leverages technical knowledge of computer systems and networks with cyber threat information to assess the client's security posture</li><li>
Conducts intelligence analysis to assess intrusion signatures, tactics, techniques and procedures associated with preparation for and execution of cyber attacks</li><li>
Researches hackers, hacker techniques, vulnerabilities, exploits, and provides detailed briefings and intelligence reports to leadership</li></ul>
Qualifications:
<ul><li>Bachelor's with 8+ years of cyber security experience (or commensurate experience)</li><li>
7 years of security intrusion detection examination experience involving a range of security technologies that product logging data; to include wide area networks host and network IPS/IDS/HIPs traffic event review, server web log analysis, raw data logs</li><li>
Working experience of Splunk SIEM. Contractor will have at least two years as a cyber security or security operations shift team leader</li><li>
At least five years&rsquo; experience working at a senior level, performing analytics examination of logs and console events in the following working experience areas of; creating advance queries methods in Splunk or advance Grep skills, firewall ACL review, examining Snort based IDS events, Pcaps, web server log review, and working in a SIEM environment</li></ul><br>
<div></div>
Posted Salary Range: USD $108,310.00 - USD $150,000.00 /Yr.</div>

Intrusion Detection Team Lead - 3rd shift

<div>Overview:
<div>
GovCIO is currently hiring for a 3rd shift (11pm - 7:30am) Incident Handler/Security Analyst to support the US Courts in Washington, DC (4 days onsite, Fridays remote).</div>
Responsibilities:
<div>
Correlates threat data from various sources to establish the identity and modus operandi of hackers active in client's networks and posing a potential threat. Provides the customer with assessments and reports facilitating situational awareness and understanding of current cyber threats and adversaries. Develops cyber threat profiles based on geographic region, country, group, or individual actors. Produces cyber threat assessments based on entity threat analysis. May provide computer forensic and intrusion support to high technology investigations in the form of computer evidence seizure, computer forensic analysis, data recovery, and network assessments. Researches and maintains proficiency in tools, techniques, countermeasures, and trends in computer network vulnerabilities, data hiding and network security and encryption.</div><ul><li>
Collaborates with intrusion analysts to identify, report on, and coordinate remediation of cyber threats to the client</li><li>
Provides timely and actionable sanitized intelligence to cyber incident response professionals</li><li>
Leverages technical knowledge of computer systems and networks with cyber threat information to assess the client's security posture</li><li>
Conducts intelligence analysis to assess intrusion signatures, tactics, techniques and procedures associated with preparation for and execution of cyber attacks</li><li>
Researches hackers, hacker techniques, vulnerabilities, exploits, and provides detailed briefings and intelligence reports to leadership</li></ul>
Qualifications:
<ul><li>Bachelors Degree with 5+ years of security analysis experience (or commensurate experience)</li><li>
Certification required: Splunk Fundamentals I &amp; II certification</li><li>
Clearance Required: Ablity to maintain a public trust clearance</li></ul><div>
Preferred</div><div></div><div><br>
Bachelor&rsquo;s Degree in Information Systems, Computer Science , Cybersecurity or related field</div>
Posted Salary Range: USD $81,850.00 - USD $110,000.00 /Yr.</div>

Incident Handler/Security Analyst - 3rd shift

MANTECH

<div><p><b>MANTECH </b>seeks a motivated, career and customer-oriented <b>COMSEC Information Security Specialist </b>to join our team in <b>Washington, D.C..
</b></p><p><b>Responsibilities include but are not limited to:</b></p><ul><li>
Responsible for applying Information Assurance expertise and knowledge to network and/or enterprise security.</li><li>
Familiar with and able to apply &ldquo;best practices&rdquo; security methodologies.</li><li>
Functional expertise in one or more information assurance technologies or capabilities such as Vulnerability/Threat Assessments, Network Intrusion Detection, Secure Operations, Firewall Design &amp; Deployment, Public Key Encryption, Virtual Private Networks, etc. Provides COMSEC helpdesk support to client&rsquo;s personnel during normal business hours and during emergency events</li><li>
Interfaces with all necessary levels of management and staff regarding Information Assurance services.</li><li>
Maintains and updates client&rsquo;s COMSEC Policy Guide and COMSEC SOPs. Conduct semi-annual inventories of COMSEC sub-accounts.</li><li>
Plans and conducts compliance audits and inspections on client&rsquo;s COMSEC accounts.</li><li>
Provides COMSEC Access Briefings and debriefings when requested by the client.</li></ul><p></p><p><b>
Minimum Qualifications:</b></p><ul><li>
B.A. or B.S. in related field with one (1) year of experience maintaining and sustaining enterprise environments. Degree may be substituted for four (4) years of professional enterprise services experience for a total of five (5) years.</li><li>
Strong understanding of COMSEC disciplines.</li><li>
Knowledgeable about the National Security Agency (NSA) policies and accounting procedures required for coordinating customers&rsquo; requirements and resolving COMSEC matters.</li><li>
Strong proficiency in Microsoft Excel.</li></ul><p></p><p><b>
Preferred Qualifications:</b></p><ul><li>
4 years of customer service, administrative services/Asset Management experience</li><li>
4 years of COMSEC custodian experience</li><li>
Security+ certification</li></ul><p></p><p><b>
Clearance Requirements:</b></p><ul><li>
Must be a US Citizen and possess a current/active TS/SCI clearance</li><li>
Must be willing and able to pass a polygraph</li></ul><p></p><p><b>
Physical Requirements:</b></p><ul><li>
The person in this position must be able to remain in a stationary position 50% of the time. Occasionally move about inside the office to access file cabinets, office machinery, or to communicate with co-workers, management, and customers, via email, phone, and or virtual communication, which may involve delivering presentations.</li><li>
Must be able to lift and move hardware weighing up to 50 pounds.</li></ul></div><p></p>

COMSEC Information Security Specialist

Washington Financial

<div>
 <strong>
  Information Security Analyst
 </strong>
 <p>
  Washington Financial Bank
 </p>
 <p>
  Washington, PA (On-site)
 </p>
 <p>
 </p>
 <p>
 </p>
 <strong>
  Position Overview
 </strong>
 <p>
  The Information Security Analyst is responsible for supporting and maintaining the Bank&rsquo;s network and security infrastructure. This role focuses on threat detection and prevention, security monitoring, vulnerability management, incident response, and regulatory compliance. The analyst partners closely with the Information Security Manager, internal teams, and third-party providers to ensure a secure operating environment.
 </p>
 <strong>
  Key Responsibilities
 </strong>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Implement, administer, and support security technologies including firewalls, endpoint protection, IDS/IPS, VPNs, and web/email filtering
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Monitor and analyze security logs, SIEM alerts, and network traffic for suspicious or unusual activity
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Perform threat hunting, threat intelligence analysis, and vulnerability scanning
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Investigate security incidents and recommend remediation and mitigation strategies
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Maintain and enforce security policies, access controls, and user profile security
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Coordinate system, application, and hardware patching to address security risks
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Manage device encryption and data protection controls
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Support regulatory, audit, and compliance requirements and address audit findings
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Work with vendors and managed service providers to implement upgrades, patches, and replacements
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Conduct access reviews, user activity audits, and security reporting
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Provide IT helpdesk or project support as needed
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Prepare reports and updates for management on security posture and incidents
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Perform other duties as assigned in support of risk management and Bank operations
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Ensure compliance with Bank policies and applicable regulatory requirements (including CRA, ECOA, and BSA)
 </p>
 <p>
  <br/>
 </p>
 <strong>
  Required Qualifications
 </strong>
 <p>
  <br/>
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Associate&rsquo;s degree in Information Technology/Information Security, Bachelor&rsquo;s degree in Computer Science or related field strongly preferred or the equivalent combination of education and work experience
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Industry certifications required - CompTIA Network+ and Security+ certifications strongly preferred
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Additional certifications (SANS, ISC&sup2;, ISACA) are beneficial but not required
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Minimum of
  <strong>
   2 years of experience
  </strong>
  in information security or a related IT role
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Strong understanding of network security, operating systems, protocols, and telecommunications
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Experience with SIEM tools, antivirus/EDR, vulnerability assessment, and intrusion detection/prevention
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Strong analytical, problem-solving, and communication skills
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Ability to work collaboratively across departments
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Working knowledge of banking operations and regulatory requirements preferred
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Ability to lift up to 25 lbs. and possess a valid driver&rsquo;s license
 </p>
 <strong>
  Work Environment
 </strong>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Primary location: 190 North Main Street, Washington, PA 15301
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Occasional travel to external locations as needed
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Office environment with regular computer and network equipment used
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Position is not remote, but hybrid will be considered
 </p>
 <strong>
  Why Join Washington Financial Bank?
 </strong>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Stable, community-focused financial institution
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Opportunity to work hands-on with modern security technologies
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Collaborative team environment
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Meaningful involvement in community and charitable programs
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;A family-first company valuing employee work/life balance
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Competitive compensation and benefits package
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Affordable medical, dental, and vision coverage
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;401(k) plan with 5% employer match
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;11 Paid holidays
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;16 PTO days after 1
  <sup>
   st
  </sup>
  year and optional PTO purchase program
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Up to 2 paid community service days per year
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Employee discounts on products and services
 </p>
 <p>
  &middot;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Commitment to compliance, ethics, and professional growth
 </p>
 <p>
  <strong>
   Apply online at
  </strong>
  <strong>
   www.washfin.bank
  </strong>
  <strong>
   or by mail to 190 North Main Street, 4
  </strong>
  <sup>
   <strong>
    th
   </strong>
  </sup>
  <strong>
   Floor, Washington, PA
  </strong>
 </p>
 <p>
  <strong>
   Washington Financial Bank is an Equal Opportunity Employer
  </strong>
 </p>
 <p>
  <br/>
 </p>
</div>


Information Security Analyst

Cape Fox Federal Integrators

<div>Job Description:<p><br>
Cape Fox Federal Integrators (CFFI) is seeking an experienced Cybersecurity Engineer. This position is contingent upon award.</p>
<p><i>The salary range (or hiring range) for this position has been established at: $145,000.00 - $180,000.00</i></p>
<p><i>The above salary range represents the company&rsquo;s good faith and reasonable estimate of the range of possible compensation at the time of posting. In addition, for fulltime, benefit eligible positions we offer a variety of benefits including company holidays, paid time off, health insurance, dental insurance, vision insurance, life and disability insurance as well as 401K with company match.</i></p>
<p>Duties and responsibilities include:</p>
<ul><li>Apply knowledge and skills of information systems security principles, NIST guidelines, FISMA, CISA, and federal directives, to conduct ongoing security assessments of installed systems and networks with a view to recommend corrective actions.</li>
<li>Perform systems engineering and maintenance activities according to established standards.</li>
<li>Apply knowledge of Networking Technologies including LAN, MS Azure, and Wireless management in security solutions implementation and troubleshooting.</li>
<li>Develop NIGC security operations capabilities by evaluating current strategies and pursuing alignment with best practices.</li>
<li>Ensure the effective configuration and daily operations of tools that support the NIGC cybersecurity strategy. Such tools include SEIM integration, Syslog, Network Detection and Response (NDR), Endpoint Detection and Response (EDR), Firewalls, M365 Cloud security, Defender for Cloud, and Continuous Diagnostics &amp; Mitigation (CDM) capabilities.</li>
<li>In collaboration with CISO and Privacy Officer develop plans, techniques, and measurable objectives to improve the development of cybersecurity and privacy measures that meet NIGC goals for protecting sensitive information.</li>
<li>Collaborate with other teams on the integration of NIGC Applications and IT services to consider security implications and ensure that NIGC security requirements are met.</li>
<li>Maintain threat awareness and monitor NIGC information systems for exploits and any suspicious activities. Analyze aggregated logs from security tools and perform regular threat hunting activities.</li>
<li>Develop Security Orchestration and Automation capabilities.</li>
<li>Adhere to Continuous Monitoring practices to evaluate the effectiveness of implemented security controls and execute proactive threat hunting activities to ensure confidentiality, integrity, and availability of NIGC information systems.</li>
<li>Develop detection and response configuration policies to increase automation.</li>
<li>Execute Incident Response activities to include all associated actions according to the NIGC incident response plan.</li>
<li>Develop Incident handling procedures.</li>
<li>Validate that sufficient and relevant information is captured and retained from security tools to support actionable security awareness and incident investigations.</li>
<li>Collect security operations performance and NIGC security posture management metrics and prepare NIGC threat reports to inform risk management decisions.</li>
<li>Develop and maintain accurate security operations documentation including the preparation of standard operating procedures for recurring tasks.</li>
</ul>
<p>Plans and designs security solutions and capabilities that enable the organization to identify, protect, detect, respond, and recover from cyber threats and vulnerabilities. Defines and develops security requirements using risk assessments, threat modeling, testing, and analysis of existing systems. Develops security integration plans to protect existing infrastructure and to incorporate future solutions. Creates action plans for policy creation and governance, system hardening, monitoring, incident response, disaster recovery, and emerging cybersecurity threats. Utilizes security information and event management (SEIM), data loss prevention (DLP), intrusion prevention systems (IPS), and other tools in action plan designs. Reviews current architectures and systems to ensure consistency and compliance with the organization's guidelines, policies, and standards. Keeps abreast of the latest cyber threat information. Typically requires a bachelor's degree.</p><br>
<p></p>
<br>
<br>
<b>Job Requirements:</b><br>
<ul>
<li>Bachelor's Degree</li>
<li>Certified Information Security Manager (CISM) or Certified Information Systems Security Professional (CISSP) desired.</li>
<li>Must be willing to complete applicable background investigations, obtain and maintain a Public Trust clearance, execute a Non-Disclosure Agreement (NDA), comply with all NIGC policies, and acknowledge and sign the NIGC Rules of Behavior</li>
<li>Authorization to work in the United States without sponsorship as defined by the Immigration Reform Act of 1986.</li>
</ul>
<p>#CJ</p></div>

Cybersecurity Engineer

Peraton

<div><div><h5 class="jobSectionHeader"><b>ABOUT PERATON</b></h5><p>
Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the world&rsquo;s leading mission capability integrator and transformative enterprise IT provider, we deliver trusted, highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land, sea, space, air, and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day, our employees solve the most daunting challenges that our customers face. Visit peraton.com to learn how we&rsquo;re keeping people around the world safe and secure.</p></div><div><h5 class="jobSectionHeader"><b>
ABOUT THE ROLE</b></h5><div><div>
Peraton is seeking a <b>Senior Cybersecurity Engineer (SME)</b> to support a federal customer&rsquo;s <b>Virtual Security Operations Center (vSOC)</b>.</div><div><br>
</div><div><b>Location: Washington, DC</b></div><div></div><div><br>
This individual will serve as the technical lead for SIEM operations, detection engineering, and advanced security analytics, leveraging Microsoft Sentinel and the Microsoft Defender security stack.</div><div></div><div><br>
The ideal candidate is a hands-on technical expert who can operate at both the engineering and operational levels, ensuring comprehensive monitoring, high-fidelity detection, and actionable intelligence across enterprise environments.</div><div>
This role directly supports mission-critical cybersecurity operations protecting sensitive federal data (CUI/PII/PHI/FTI) and aligns to Zero Trust and NIST-based security frameworks.</div><div></div><div><b><br>
What You&rsquo;ll Do</b></div><div><b>
Lead Microsoft Sentinel Operations</b></div><ul><li>
Serve as the primary SME for Microsoft Sentinel, the enterprise SIEM platform
</li><li>Design, implement, and optimize analytics rules, correlation logic, and data models
</li><li>Develop advanced KQL queries, workbooks, and dashboards to support SOC operations and reporting
</li><li>Ensure all monitoring and analytics align to the Microsoft Sentinel data model
</li></ul><div><b>Drive Detection Engineering &amp; Threat Analytics</b></div><ul><li>
Lead development and continuous tuning of MITRE ATT&amp;CK-aligned detection use cases
</li><li>Implement cross-domain correlation logic spanning identity, endpoint, network, and cloud telemetry
</li><li>Perform and guide proactive threat hunting activities
</li><li>Continuously improve detection capabilities based on:
</li><ul><li>Threat intelligence
</li><li>Incident response findings
</li><li>Red team and assessment results
</li></ul></ul><div><b>Integrate and Optimize Microsoft Security Stack</b></div><ul><li>
Leverage and optimize:
</li><ul><li>Microsoft Defender for Endpoint (MDE) for endpoint visibility
</li><li>Microsoft Defender for Identity (MDI) for Active Directory and identity monitoring
</li></ul><li>Ensure all Defender telemetry is:
</li><ul><li>Properly ingested into Sentinel
</li><li>Actively monitored and correlated
</li><li>Optimized for detection and response
</li></ul></ul><div><b>Engineer Multi-Source Log Ingestion &amp; Normalization</b></div><ul><li>
Lead ingestion and integration of non-Microsoft data sources, including:
</li><ul><li>AWS CloudTrail and VPC Flow Logs
</li><li>Proofpoint email security logs
</li><li>Veeam backup logs
</li><li>Checkpoint and Cisco network/security logs
</li><li>iBoss proxy logs
</li><li>VPN and remote access logs
</li></ul><li>Ensure all telemetry is:
</li><ul><li>Normalized to Sentinel schema</li><li>
Aligned for cross-plane correlation
</li><li>Optimized for detection engineering and threat hunting
</li></ul></ul><div><b>Ensure Data Integrity &amp; Pipeline Health</b></div><ul><li>
Oversee ingestion pipelines to ensure:
</li><ul><li>Log integrity and completeness</li><li>
Accurate timestamping and synchronization
</li><li>Proper schema mapping and field normalization
</li></ul><li>Monitor ingestion health to identify:
</li><ul><li>Dropped or malformed logs
</li><li>Latency or ingestion failures
</li></ul><li>Configure and manage log routing tools (e.g., Cribl), ensuring:
</li><ul><li>No data loss
</li><li>Preservation of original log fidelity
</li></ul></ul><div><b>Enable Cross-Plane Security Visibility</b></div><ul><li>
Implement and maintain end-to-end visibility across:
</li><ul><li>Identity
</li><li>Endpoint
</li><li>Network
</li><li>Cloud
</li></ul><li>Develop correlation strategies that:
</li><ul><li>Map to MITRE ATT&amp;CK techniques
</li><li>Support advanced threat detection
</li><li>Enable full attack path analysis
</li></ul></ul><div><b>Deliver Operational Reporting &amp; Dashboards</b></div><ul><li>
Build and maintain real-time dashboards and automated reporting within Sentinel
</li><li>Provide visibility into:
</li><ul><li>Detection performance (MTTD/MTTR)
</li><li>Log ingestion health
</li><li>Threat trends and risk posture
</li></ul><li>Support delivery of:
</li><ul><li>Operational SOC reporting
</li><li>Executive-level insights
</li><li>Compliance and audit artifacts
</li></ul></ul><div><b>Mentor and Lead Technical Teams</b></div><ul><li>
Serve as a technical escalation point and mentor for SOC analysts (Tier I&ndash;III)
</li><li>Provide guidance on:
</li><ul><li>Detection strategy
</li><li>Log onboarding
</li><li>Security architecture improvements
</li></ul><li>Collaborate with:
</li><ul><li>Incident Response teams
</li><li>Cloud and infrastructure teams</li><li>
Government stakeholders</li></ul></ul></div></div><div></div><div><h5 class="jobSectionHeader"><b><br>
QUALIFICATIONS</b></h5><div><div><b>
Required:</b></div><div></div><div><b><br>
Education &amp; Experience:
</b></div><ul><li>Bachelors degree and a minimum of 8 years of relevant experience. An additional 4 years of experience in lieu of degree.</li><li>
Minimum of 8 years of cybersecurity experience, including:<ul><li>
5+ years in SOC, SIEM, or detection engineering roles
</li><li>3+ years of hands-on experience with Microsoft Sentinel
</li></ul></li><li><b>Technical Skills</b><ul><li>
Deep expertise in:
<ul><li>Microsoft Sentinel (analytics, KQL, data models)
</li><li>Microsoft Defender for Endpoint (MDE)
</li><li>Microsoft Defender for Identity (MDI)
</li></ul></li><li>Strong experience with:
<ul><li>Log ingestion, normalization, and schema mapping
</li><li>Multi-source telemetry integration (cloud, network, endpoint)
</li><li>AWS logging (CloudTrail, VPC Flow Logs)
</li></ul></li><li>Knowledge of:
<ul><li>MITRE ATT&amp;CK framework
</li><li>SIEM/XDR integration
</li><li>Log routing tools (e.g., Cribl, Logstash, Fluentd)</li></ul></li></ul></li><li><b>
U.S citizenship required</b></li><li><b>
Ability to obtain Top Secret Clearance</b></li></ul><div></div><div><b><br>
Preferred:</b></div><ul><li>
Relevant certifications:
</li><ul><li>CISSP, GCIA, GCIH, CEH, or equivalent
</li><li>Microsoft Security certifications (Sentinel, Defender)
</li><li>AWS Security certifications
</li><li>Privacy certifications (e.g., CIPP/US, CIPM) where applicable
</li></ul><li>Experience supporting:
</li><ul><li>Federal civilian agencies
</li><li>NIST-based frameworks (800-53, 800-61, 800-92)
</li><li>Zero Trust architectures
</li></ul></ul><div><b>What Sets You Apart</b></div><ul><li>
Ability to operate as both a <b>hands-on engineer and strategic technical leader</b>
</li><li>Experience building <b>detection capabilities from the ground up</b>
</li><li>Strong understanding of <b>identity-centric security and Zero Trust principles</b>
</li><li>Proven ability to <b>optimize security operations for efficiency and cost</b></li></ul></div></div><div></div><div><h5 class="jobSectionHeader"><b><br>
DETAILS</b></h5><div><p>
<b>Target Salary Range:</b> $135,000 - $216,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual&rsquo;s experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.
</p></div><div><p>
<b>Benefits Statement:</b> Peraton offers eligible employees a variety of benefits including medical, dental, vision, life, health savings account, short/long term disability, EAP, parental leave, 401(k), paid time off (PTO) for vacation, and company paid holidays. A full listing of available benefits can be viewed at https://www.careers.peraton.com/benefits.
</p></div><div><p>
<b>Application Statement:</b> The application period for the job is estimated to be 30 days from the job posting date. However, this timeline may be shortened or extended depending on business needs and the availability of qualified candidates.
</p></div><p><b>
EEO:</b> Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.</p></div></div><div></div>

SENIOR CYBERSECURITY ENGINEER (SME)

Explore 629+ Intrusion detection team lead 2nd shift in Washington this May. Find roles across top companies and apply now to boost your career.