Cyber Engineer Principal

SAIC•Washington, DC

6h•Remote

About The Position

SAIC is hiring a highly hands-on Principal Cyber Engineer to serve as a subject-matter expert and provide technical cyber engineering, assessment, modernization, and enablement support. The role focuses on exploring and applying security capabilities across Zero Trust, cloud security, AI platforms, and security data engineering, including experimenting with tools and developing scripts, queries, job aids, and other practical artifacts. The role is described as remote, with candidates required to live within commuting range of Reston, Virginia. Work is primarily from home, with regular work in customer spaces in Virginia or Washington, D.C., the Reston proposal center, and the Air Force Business Group in Crystal City. Occasional travel is required, sometimes on short notice; assignments may range from two days to 50 percent time for nine months, and occasional trips may last up to six weeks. Candidates must hold an active Top Secret clearance and be eligible to obtain SCI.

Requirements

Bachelor’s degree and 9 years of experience, or a master’s degree and 7 years of experience.
U.S. citizenship.
Active Top Secret clearance and ability to obtain SCI.
Residence within commuting range of Reston, Virginia.
Current CompTIA Security+ CE or equivalent 8140 intermediate certification.
Typically 8 or more years of hands-on cyber engineering, SOC/SIEM architecture, enablement, or equivalent experience at Senior Principal depth.
Ability to drive a team and advise a contract cyber lead.
Experience assessing cyber programs and environments against frameworks and recommending solutions, modernization, and automation.
Experience working in customer spaces, including mixed-classification environments, on a support-request cadence.
Technical depth in Zero Trust and AI platforms; data engineering applied to security telemetry; and SIEM automation or SOC tooling and architecture.
Working familiarity with RMF, CMMC, ICD-705, incident response, security architecture, cloud security architecture, endpoint security platforms, DLP, IPS, and load balancers.
Ability to explain time-indexed versus stateful data, why both are needed in a security environment, and how tools and vendors provide them for Zero Trust activity targets.
Strong troubleshooting skills and current command-line skills on Windows and Linux, such as PowerShell and Bash or equivalents.
Hands-on AWS Console and AWS CLI experience with IAM, CloudTrail, GuardDuty, Security Hub, VPC/flow logs, S3, CloudWatch, or equivalents.
Clear communication and teaching skills, including writing job aids and presenting to technical and non-technical audiences.
Ability to travel occasionally, including on short notice.

Nice To Haves

Current SCI; TS/SCI with Poly is a plus for high-end Service Delivery customers.
Splunk experience; Splunk Certified Admin or higher, or equivalent security data engineering knowledge and experience with tools such as Splunk, Elastic, or Sentinel.
CISSP or higher, such as ISSAP, ISSEP, or ISSMP.
Additional current credentials in cloud, detection, architecture, or data, such as CCSP, CISM, GIAC, AWS/Azure security, CySA+, CASP+, or equivalent.
Proposal or capture technical consulting experience; published or internal white papers; prior enablement of mixed-skill cyber teams.
Interest in AI governance and securing AI agents and tool gateways.
Experience with SOAR, EDR/XDR, identity platforms, security data lakes, and securing AI/ML platforms such as Azure OpenAI, Bedrock, on-premises model hosting, or RAG/LLMOps controls.

Responsibilities

Enter customer spaces on short notice, learn the environment and stakeholders quickly, and leave usable technical artifacts.
Drive cyber teams in new, under-resourced, or stalled environments, then hand the work back in a runnable state.
Consult with contract cyber leads without replacing them; lead teams and advise cyber leads.
Assess cyber programs and customer environments against applicable cyber and security frameworks.
Recommend solutions, modernization, automation, and next steps to mature innovation environments.
Work on Zero Trust, AI platform security, security-telemetry data engineering, and SIEM/SOC architecture and automation.
Support AI governance efforts and securing AI agents and tool gateways.
Apply RMF, CMMC, and ICD-705 in operational environments and support incident response.
Engineer and tune security and cloud architecture, endpoint platforms, DLP, IPS, and load-balancer and traffic paths.
Use both time-indexed and stateful data, and work with platforms and vendors so both support Zero Trust activity targets.
Troubleshoot using command-line tools, including Windows, Linux, security-tool CLIs, AWS Console, and AWS CLI; escalate issues with evidence.
Teach, present white papers, write job aids for new and existing frameworks, and contribute technical content to proposals.