4272 Senior Security Engineer

4272 Senior Security Engineer 4272 | Top Secret Job Description: OVERVIEW: We are seeking a highly skilled Senior Security Engineer to provide expertise, guidance, recommendations and document security configurations for the implementation of security tools and processes for government networks. The Senior Security Engineer shall include the installation, analysis, and troubleshooting of data/security networks and devices to include network and software system. GENERAL DUTIES: • Develop technical solutions and new security tools to help mitigate security vulnerability and automate repeatable tasks; • Assist security personnel with responding to incidents across a wide array of technologies, mitigate and contain impacts, coordinate remediation efforts, and summarize recommendations for improvements; • Provide up-to-date reports on security incidents and task process; and • Maintain documentation to support security strategies by outlining the requirements and benefits of specific security tools and/or solutions. REQUIRED QUALIFICATIONS: • At least six (6) years of experience as Security Analyst in a corporation, government, or service firm. • Experience using and administering SIEM and analytics solutions (Splunk, Elastic Stack (Elasticsearch, Logstash, Kibana - ELK), or similar) required. • Experience conducting security assessments, penetration testing and/or ethical hacking, and identifying and mitigating vulnerabilities required. • Ability to engineer and deploy critical security analytic services including, but not limited to, IPS/IDS, EDR, and SIEM solutions to secure the enterprise. • Industry security certification such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CSIM), Security+, or similar certification is required. • Bachelor of Science Degree in Computer Science, Computer Engineering, Cybersecurity or related field of study; or in lieu of education, five additional years of relevant experience. DESIRED QUALIFICATIONS: • Architect and operate a hybrid SIEM stack spanning Microsoft Sentinel and Splunk Enterprise across on-prem, Azure, AWS; design ingestion pipelines (DCR/AMA, Splunk UF/HF/HEC), normalization with ASIM/CIM, and cross-workspace/cross-tenant event sharing. • Lead security architecture reviews and reference designs aligned to Zero Trust, NIST 800-53/207, CNSSI 1253; deliver threat models, control mappings, and security data flow diagrams for collection networks. • Build and maintain detections-as-code: author and version KQL/SPL analytics, watchlists, and entity behavior rules with MITRE ATT&CK coverage. • Administer a proactive threat-hunting program using KQL/SPL, Jupyter notebooks (MSTICPy), Sigma conversion, and purple-team ATT&CK emulations; convert hunt findings into resilient analytics and anomaly baselines. • Optimize telemetry governance and cost: table/namespace policies, retention tiers/archival, Splunk license & index strategy, Sentinel ingestion caps and data filters, plus egress controls for FOUO/SCI data. • Establish incident response operations and SLOs: unify case management (Sentinel Incidents, Splunk ES Notables), evidence handling, post-incident reviews, and executive dashboards/metrics for readiness and dwell time. • Provide tiered platform support and enablement: backlog grooming, rule/playbook QA, change control, analyst/admin training, and ATO/RMF continuous monitoring package updates as required. CLEARANCE: • Top Secret clearance and the ability to obtain a CI clearance with a polygraph. Job Details City : Quantico State : Virginia