Cyber Engineer (TO1 SOC)-Virginia Beach, VARequired Education: Bachelor's Degree in Cybersecurity or related field.Required Experience: 8-10 years of cybersecurity engineering, network security, and SIEM ingestion pipelinesLocation: Virginia Beach, VA-100% on Customer siteRequired Clearance: Active SECRET with TS/SCI eligibilityDescription:The Senior Cybersecurity Engineer will provide technical leadership, security engineering, and consulting expertise to modernize and enhance a fully operational Security Operations Center (SOC). The individual will assess existing cybersecurity capabilities, identify technology gaps and investment opportunities, and develop recommendations and implementation strategies to advance SOC effectiveness. A primary focus will be evaluating, integrating, and optimizing endpoint security technologies and defensive artificial intelligence (AI) to improve threat detection, investigation, automation, and response. The engineer will leverage broad cybersecurity expertise to architect and implement advanced security solutions, integrate enterprise technologies, and maximize the value of existing and future investments. The role will drive continuous SOC improvement through security innovation, detection engineering, threat hunting, incident response, and adoption of emerging defensive capabilities.
Responsibilities:- Security architecture and network optimization: Broad experience integrating SIEM, SOAR, EDR/XDR, IdAM security, network defense from emerging threats and vulnerabilities, and hybrid security platform capabilities into a single cohesive SOC architecture. Experience engineering solutions within existing enterprise environments, managing technical dependencies, integrating shared services, and balancing security requirements with operational constraints.
- Defensive AI and SOAR: Experience applying artificial intelligence and machine learning in defensive cybersecurity applications, including AI-enabled detection and triage, alert correlation, investigation support, security orchestration and automation (SOAR), and AI-assisted incident response. Ability to evaluate AI capabilities and address risks such as false positives, model limitations, and evaluate their effectiveness against adversarial AI.
- Security consulting and technical leadership: Proven ability to assess complex network environments, conduct capability and gap assessments, develop target-state architectures and modernization roadmaps, advise stakeholders, and lead technical strategy and implementation across multiple teams or service providers. Demonstrated ability to manage complex cybersecurity projects in a fast-paced operational environment, coordinating schedules, risks, and dependencies across multiple stakeholder teams. Contribute to the roadmap for building a unified, customer-run SOC, integrating existing enterprise services into the new construct.
- SOC operations and threat defense: Install, configure, and maintain ingestion pipelines across Splunk and Elastic environments. Practical experience improving detection engineering, threat hunting, incident response, security analytics, playbooks, operational workflows, and measurable SOC performance. Support and assess the customer's current SOC-related tools and processes, identifying existing coverage and gaps.
- Configure and monitor Secure Access Service Edge (SASE) architectures, such as Cloudflare and Zscaler security brokers, by integrating zero-trust principles, identity-aware access controls, network security, and implementing Zero Trust (ZT) security controls. Engineer and defend distributed sensor networks by strengthening endpoint and device security, securing data flows, and monitoring telemetry for anomalous activity.
Required Qualifications- Flexibility to meet any threat scenario 24/7/365 as mission dictates.
- Active SECRET clearance with TS/SCI eligibility.
- Meets CSWF requirements for CNDSP Level III. Maintains compliance with DoDD 8140.01 Cyber Workforce requirements for CNDSP Level III roles.
- 8+ years of experience working with Linux-based networks and systems with strong network and system hardening skills.
- 6+ years of experience in security architecture, installing, configuring, and maintaining data ingest pipelines (e.g., Splunk/Elastic).
- 4+ years of project management/consulting experience working with cross-functional engineering teams and/or developers.Operational experience desired.
- 4+ years of EDR/XDR, SIEM, and Cloud-native security tools experience
- 3+ years of senior engineer experience for a SOC or similar technical leadership role
- 2+ years of experience with defensive AI/ML, focused on CND and SOAR real-world applications.
- Extensive knowledge and/or experience with SOC processes such as SIEM optimization, threat hunting, and RMF.
- Strong interpersonal skills with the ability to communicate technical concepts to both technical and non-technical stakeholders.
Desirable Qualifications:- Certified Splunk Architect and/or Elastic/OpenSearch Engineer.
- CISSP, Security X, or relevant GIAC certifications (GCSA, GDSA, GDAP, GCIP).
- Experience with Microsoft Azure, Intune, Defender Endpoint Security, and Active Directory.
The salary range for this position is $158,000-$165,000 annually, commensurate with experience, qualifications, and other relevant factors.
