Cyber Data Engineer

Bristol Bay Native Corportation•San Antonio, TX

1d•Onsite

About The Position

STS Systems Defense, LLC (SSD), a government consulting and contracting firm supporting federal agencies and military installations across the U.S., is seeking a Cyber Data Engineer to support its mission at Lackland AFB in San Antonio, Texas. The role focuses on cyber data engineering, vulnerability remediation and patch management, SIEM development and operations, security assessments, and systems security engineering. The engineer develops scripts and security capabilities, augments SIEM functionality, and creates or maintains search and analytics tool knowledge objects to identify potentially malicious activity and meet compliance requirements. The role also ensures critical data feeds and hosts are reporting, develops and tests vulnerability fixes across Windows and Unix/Linux platforms, and supports security audits and implementation of security controls. Responsibilities include analyzing vulnerabilities and failed patch deployments, reporting patch compliance, assessing system hardening against applicable STIGs/SRGs, and prioritizing enterprise patching requirements. The engineer also provides vulnerability recommendations, supports operational leadership, shares knowledge with other personnel, maintains continuity materials, tracks industry trends, and creates metrics and reports to improve mission execution.

Requirements

Must be a U.S. citizen.
Must have an active TS/SCI clearance.
Graduate degree in Software Engineering; the posting also lists BA/BS or MA/MS.
More than three years of relevant work experience.
More than three years of relevant experience responding to security problems in target-rich environments, analyzing security alerts, and conducting frontline analysis and response.
Proficiency with Splunk Processing Language (SPL), ELK Lucene Query Syntax, or another search and analytics tool.
Proficiency in programming and scripting fundamentals, including regular expressions, C++, Python, RHEL, Unix scripting, and Windows PowerShell.
Linux+/Red Hat and RHEL 7 knowledge.
Understanding of SIEM search language and Lucene Query Syntax.
Understanding of SIEM dashboards, reports, lookup tables, and summary indexes.
Knowledge of customizing dashboards through XML source.
Experience with SIEM applications and ELK.
Experience with Python scripting.
Programming experience in Python, C/C++, Java, or Go.
Demonstrated expertise in malware analysis, including investigations of botnet and rootkit behavior.
Familiarity with information security concepts, including OWASP Top 10, CVEs, IoCs, TTPs, and cryptography.
Experience with network security devices, including IDS/IPS, NGFW, WAF, and NGAV.
Experience with OSSEC, Snort, and Suricata.
Experience with at least one SIEM, such as AlienVault, LogRhythm, Splunk, QRadar, or ELK, and firewalls such as Fortinet, SonicWall, or Palo Alto.
Experience with scanning technologies and log collection and analysis tools, including SIEM.
Experience with scripting or programming languages such as BASH, Python, and Java.
Extensive knowledge of the MITRE ATT&CK framework and its uses within the cybersecurity community, including open-source projects.

Responsibilities

Write and develop scripts to automate installation of required patches and configurations to remediate identified system vulnerabilities.
Perform coding and development to augment default SIEM functionality and facilitate communication among security controls.
Develop basic cybersecurity capabilities.
Develop and maintain Splunk, ELK, or other search and analytics tool knowledge objects, including saved searches, reports, dashboards, data models, event types, field aliases and extractions, macros, lookups, and tags.
Ensure critical data feeds and hosts are sending data.
Develop, debug, and maintain scripting languages and scripts.
Create, install, and test vulnerability fixes for Windows and Unix/Linux platforms.
Assist with or lead cybersecurity audits to verify appropriate implementation and compliance of the security posture.
Perform systems security engineering and testing associated with implementing security controls on network devices, databases, operating systems, hardware, and software components.
Develop vulnerability reports and investigate the impact, resolution, and verification of security vulnerabilities and patches, including deep-dive analysis of failed patch deployments.
Develop and provide regular reports on the patch management program and patch compliance status.
Provide vulnerability assessment results and recommendations to the ESM Lead and DO as necessary.
Assess known system vulnerabilities and verify system hardening and patching against current applicable STIGs, SRGs, and related checklists, maintaining an error rate of no more than 5%.
Document, implement, and prioritize patching requirements across the AFIN/AFNet enterprise.
Provide on-the-job training to contractor employees, military personnel, and/or civilian personnel.
Update continuity folders and working aids at least quarterly to support efficient transitions when personnel rotate.
Maintain currency on industry trends and provide operational reports and assessments to support development of tactics, techniques, and procedures.
Create, document, and report metrics for analysis to improve weapon system processes and mission execution.
Support operational leadership tasking related to Systems Security Engineer functions and responsibilities.