Content Developer (SIEM Cyber Security)

Bristol Bay Native Corportation • San Antonio, TX

4d • Onsite

About The Position

STS Systems Defense, LLC is seeking a Content Developer (SIEM Cyber Security) to support federal agencies and military installations at Lackland AFB in San Antonio, Texas. The role focuses on analyzing defensive cyber operations events and developing, implementing, testing, and maintaining SIEM detections, rules, dashboards, reports, and other security content. The developer uses security alerts and enriched log data to help operators identify attacks, assess security control effectiveness, monitor unauthorized outbound connections, and detect adversarial activity.

The position also involves analyzing and ingesting enterprise security logs, optimizing SIEM performance, developing use cases and virtual tripwires, tuning correlation logic to reduce false positives, and analyzing malware threats to create behavior-based detections. The developer automates SIEM tasks, maintains documentation and resources, collects and reports metrics, and produces operational reports and assessments. The role includes providing training, knowledge transfer, and on-the-job training to government personnel and other staff, as well as supporting operational leadership tasking related to content development.

Requirements

• DoDD 8570.01-M/8140.01 IAT Level III CND qualification.
• Active TS/SCI clearance.
• GMLE (GIAC Machine Learning Engineer) certification or a degree in Computer Science.
• More than five years of experience with SIEM technology such as ArcSight, Splunk, and/or ELK, including log handling, reports, filters, and rule creation.
• More than three years of experience with network traffic analysis, ports, and protocols.
• BA/BS or MA/MS degree.
• Extensive knowledge of IDS/IPS systems used by the Department of Defense, Services, and Agencies, such as the Air Force, Navy, Army, DC3, and DISA.
• SANS GCDA or equivalent certification(s).
• Extensive knowledge of the MITRE ATT&CK framework and its uses within the cybersecurity community, including open-source projects.

Nice To Haves

• More than one year of experience with SOAR platforms such as Phantom and/or Demisto.
• Proficiency in Python and PowerShell.

Responsibilities

• Analyze defensive cyber operations (DCO) events and apply current industry SIEM best practices.
• Use security alerts correlated with log enrichment data to help operators identify real attacks.
• Establish security control effectiveness and monitor for unauthorized outbound connections.
• Analyze enterprise log data to create detections and develop dashboards and visualizations for identifying adversarial activity.
• Use log data to establish and implement virtual tripwires for early detection.
• Analyze and ingest security logs into the SIEM to optimize SIEM performance.
• Design, implement, and test SIEM solutions.
• Create and support SIEM use cases, including determining the alerts and log enrichment needed to meet acceptable false-positive rates.
• Create, test, and validate filters and rules.
• Build and implement event-correlation rules, logic, and content in the SIEM.
• Tune SIEM event-correlation rules and logic to filter known network behavior, false positives, and known errors.
• Analyze malware threats and develop behavior-based detections that alert on or prevent malicious activity.
• Automate SIEM tasks using a common programming or scripting language.
• Create scheduled and ad hoc reports with SIEM tools.
• Create and maintain SIEM documentation.
• Develop and execute processes for reviewing and maintaining SIEM resources, including rules, filters, lists, trends, and reports.
• Use SIEM tools to develop metrics collection and analysis, and create reports upon request.
• Provide training and knowledge transfer on tools, processes, and procedures to government personnel upon request.
• Provide on-the-job training to contractor employees, military personnel, and/or civilian personnel.
• Update continuity folders and working aids at least quarterly to support efficient transitions when personnel rotate.
• Maintain currency on industry trends and provide operational reports and assessments for developing tactics, techniques, and procedures.
• Create, document, and report metrics to support analysis and improvement of weapon system processes and mission execution.
• Support operational leadership tasking related to content development functions and responsibilities.

Benefits

• Paid holidays.
• Paid time off, including sick and vacation leave.
• Medical insurance.
• Dental insurance.
• Vision insurance.
• Flexible spending accounts.
• Short- and long-term disability insurance.
• Company-paid life insurance.
• 401(k) with company match.
• Discretionary profit sharing.
• Tuition reimbursement.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level