Cloud Response SME

Sentar•Quantico, VA

12d•Onsite

About The Position

Sentar is seeking a Cloud Response SME to support a customer in Quantico, Virginia. The role serves as the primary technical authority for engineering, optimizing, and maintaining defensive cyberspace operations (DCO) infrastructure across customer cloud environments. The SME protects mission-critical systems by designing, implementing, and maintaining threat detection use cases for identifying unauthorized activity through cloud-native tools and cross-domain enterprise solutions. The position manages cloud incident investigations and response actions, supports the design and deployment of cloud DCO capabilities, and helps maintain the Government’s CSSP accreditation. The SME also updates tactics, techniques, procedures, training, and education documentation at least annually, and prepares and presents an annual course on cloud security, common attack scenarios, and DCO-specific practices. The course must achieve an average student satisfaction rating of at least 90%.

Requirements

Hold IAT III and CSSP Incident Responder certifications. Listed IAT III certifications include CASP+ CE, CCNP Security, CISA, CISSP or Associate, GCED, GCIH, and CCSP. Listed CSSP Incident Responder certifications include CEH, CFR, CCNA Cyber Ops, CCNA-Security, CHFI, CySA+, GCFA, GCIH, SCYBER, and PenTest+.
Be eligible for a TS/SCI clearance.
Have a technical bachelor’s degree or additional years of experience.
Have at least five years of demonstrated experience investigating incidents in cloud environments.
Have experience handling national- and state-level intrusions.
Have expertise in cloud computing environments and the ability to build and maintain detection use cases for unauthorized activity.
Have experience with Tanium, Microsoft Defender for Endpoint, Elastic/Kibana, and tools included in the DoD’s Joint Regional Security Stack (JRSS).
Have experience designing and implementing defensive cyberspace tools in cloud environments.

Responsibilities

Develop detection use cases to identify unauthorized activity in cloud environments using Government cloud defense tools, including Azure Active Directory and Microsoft Sentinel.
Assist with investigating and responding to cyberspace incidents involving cloud environments and technologies.
Assist the Government with designing and deploying new DCO capabilities in cloud environments.
Identify and/or prevent Red Team activity in the Government’s cloud environment.
Update task-related tactics, techniques, procedures, training, and education documentation at least once per calendar year.
Prepare and present at least one course per calendar year covering cloud computing security basics, common attack scenarios, and DCO Division-specific tactics, techniques, processes, and procedures.
Maintain an average satisfaction rating of at least 90% on Government-approved student satisfaction surveys.
Support maintenance of the Government’s CSSP accreditation according to the CSSP program manual and DOD-8530.01-M, including documentation and technical writing as needed.

Benefits

Voluntary medical, dental, and vision coverage, with flexible spending plan options.
Voluntary life, critical illness, accident, and long-term care insurance options.
Group term life insurance and short- and long-term disability coverage for qualifying employees.
401(k) match.
PTO plan that graduates quickly with years of service.
Other leave programs, including holidays, bereavement, maternity, jury duty, and military duty leave.
Tuition reimbursement.
Professional development reimbursement.
Recognition and awards programs.
Employee ownership.