Cyber Engineer Principal

SAIC•Reston, VA

11h•Remote

About The Position

SAIC is seeking a highly hands-on Principal Cyber Engineer and subject-matter expert to assess and improve customer cyber environments, develop practical security solutions, and help teams adopt emerging capabilities. The role focuses on Zero Trust, AI platform security, security telemetry data engineering, and SIEM/SOC architecture and automation, as well as supporting AI governance and security for AI agents and tool gateways. The engineer may enter customer environments on short notice, quickly understand the technology stack and team, produce usable artifacts, and help drive a cyber team until it can operate independently. The role consults with and supports contract cyber leads rather than replacing them. The position is remote, with candidates required to live within commuting range of Reston, Virginia. Work is primarily from home, with regular work in customer spaces in Virginia or Washington, D.C., the Reston proposal center, and the Air Force Business Group in Crystal City. Occasional travel is required, sometimes on short notice; assignments may range from two days to 50 percent of a nine-month period, and occasional trips may last up to six weeks. Longer trips are planned in advance. An active Top Secret clearance and eligibility for SCI are required. The engineer assesses programs and environments against applicable cyber and security frameworks; recommends modernization, automation, and other next steps; applies RMF, CMMC, and ICD-705 in operational settings; supports incident response; and engineers and tunes security and cloud architecture, endpoint platforms, DLP, IPS, and load-balancer and traffic paths. The role uses command-line troubleshooting across Windows and Linux, security tools, and AWS, escalates issues with evidence, teaches and presents to technical and non-technical audiences, writes job aids and white papers, and contributes technical expertise to proposals. A key technical focus is using both time-indexed and stateful data, and the platforms and vendor relationships that make both available to support Zero Trust activity targets.

Requirements

Bachelor’s degree and 9 years of experience, or a master’s degree and 7 years of experience.
U.S. citizenship.
Active Top Secret clearance and ability to obtain SCI.
Must live within commuting range of Reston, Virginia.
Current CompTIA Security+ CE or equivalent 8140 intermediate certification.
Typically 8 or more years of hands-on cyber engineering, SOC/SIEM architecture, enablement, or equivalent experience at Senior Principal depth.
Ability to drive a team and advise a contract cyber lead.
Experience assessing cyber programs and environments against security frameworks and recommending solutions, modernization, and automation.
Proven experience working in customer spaces, including mixed-classification environments, on a support-request cadence.
Technical depth in Zero Trust and AI platforms, security telemetry data engineering, and SIEM automation or SOC tooling and architecture.
Working familiarity with RMF, CMMC, ICD-705, incident response, security architecture, cloud security architecture, endpoint security platforms, DLP, IPS, and load balancers.
Ability to explain time-indexed versus stateful data, why security environments need both, and how tools and vendors provide them for Zero Trust activity targets.
Strong troubleshooting skills and current Windows and Linux command-line skills, such as PowerShell and Bash or equivalents.
Hands-on experience with AWS Console and AWS CLI, including IAM, CloudTrail, GuardDuty, Security Hub, VPC/flow logs, S3, and CloudWatch or equivalents.
Clear communication and teaching skills, including writing job aids and presenting to technical and non-technical audiences.
Ability to travel occasionally, sometimes on short notice.

Nice To Haves

Current SCI; TS/SCI with Poly is a plus for high-end Service Delivery customers.
Splunk experience is strongly preferred.
Splunk Certified Admin or higher, or equivalent security data engineering knowledge and experience not limited to a single tool.
CISSP or higher certification, such as ISSAP, ISSEP, or ISSMP.
Additional current credentials in cloud, detection, architecture, or data, such as CCSP, CISM, GIAC, AWS/Azure security, CySA+, or CASP+, or equivalents.
Proposal or capture technical consulting experience.
Published or internal white papers.
Prior enablement of mixed-skill cyber teams.
Interest in AI governance and securing AI agents and tool gateways.
Experience with SOAR, EDR/XDR, identity platforms, security data lakes, and securing AI/ML platforms, including Azure OpenAI, Bedrock, on-premises model hosting, and RAG/LLMOps controls.

Responsibilities

Enter customer environments on short notice, learn their technology stacks and teams quickly, and leave usable artifacts.
Drive cyber teams in new, understaffed, or stalled environments, then hand the work back in a runnable state.
Consult and coordinate with contract cyber leads rather than replacing them.
Assess cyber programs and customer environments against applicable cyber and security frameworks.
Recommend solutions, modernization, automation, and next steps to mature customer innovation environments.
Work on Zero Trust, AI platform security, security telemetry data engineering, and SIEM/SOC architecture and automation.
Support AI governance and the security of AI agents and tool gateways.
Apply RMF, CMMC, and ICD-705 in operational environments.
Support incident response.
Engineer and tune security and cloud architecture, endpoint platforms, DLP, IPS, and load-balancer and traffic paths.
Use time-indexed and stateful data together, including platforms and vendor relationships that provide both to support Zero Trust activity targets.
Troubleshoot using command-line tools across Windows, Linux, security tools, and AWS; escalate issues with evidence.
Teach and advise, present white papers, and write job aids for new and established frameworks.
Contribute technical expertise to proposals.