Cyber Security Engineer

Seneca Holdings•Orlando, FL

3d•Onsite

About The Position

Seneca Technologies, part of the Seneca Nation Group portfolio, is seeking a Cyber Security Engineer I to support Security Operations Center (SOC) operations in Orlando, Florida. The role focuses on monitoring, investigating, and responding to cybersecurity events across enterprise Linux environments using Security Information and Event Management (SIEM) technologies. The engineer will work collaboratively with cybersecurity engineers and operational teams to maintain the availability, integrity, and effectiveness of cybersecurity monitoring capabilities in a Department of Defense environment. The position includes continuous security alert monitoring, investigating and documenting events, checking log ingestion and monitoring platform health, validating detections, and maintaining cybersecurity procedures and documentation. The engineer will also collaborate with more senior engineers during advanced investigations and support incident response activities as required.

Requirements

Active Top Secret/Sensitive Compartmented Information (TS/SCI) security clearance.
Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related technical field; equivalent combinations of education, professional certifications, military service, and relevant professional experience will be considered.
At least 3 years of relevant professional experience supporting cybersecurity operations, network monitoring, enterprise Linux environments, or equivalent technical disciplines.
Experience performing cybersecurity alert monitoring and incident investigations.
Experience supporting enterprise Linux environments.
Experience using enterprise monitoring or SIEM technologies.
Experience documenting investigative findings using ticketing, case management, or equivalent systems.
Ability to analyze and interpret security events to identify suspicious or malicious activity.

Nice To Haves

Active Security+, CySA+, or equivalent cybersecurity certification satisfying applicable Department of Defense cybersecurity workforce requirements is highly preferred.
Linux+ or Elastic Certified SIEM Analyst certification.
Experience using enterprise SIEM technologies such as Elastic, Splunk, or equivalent technologies.
Experience monitoring enterprise Linux environments, network security events, and cybersecurity telemetry.
Familiarity with MITRE ATT&CK methodologies and cybersecurity frameworks.
Experience using Jira, Confluence, or comparable collaboration platforms.
Experience supporting cybersecurity operations in Government, Department of Defense, or enterprise environments.
Familiarity with cybersecurity incident response processes and investigative methodologies.
Experience developing dashboards, visualizations, and reporting capabilities supporting cybersecurity operations.
Experience supporting Elastic Security, Elastic Observability, Elastic Agents, or Logstash.

Responsibilities

Continuously monitor security alerts and operational anomalies using enterprise SIEM technologies in support of SOC operations.
Analyze, triage, and investigate security events generated by enterprise monitoring and security platforms.
Monitor enterprise Linux environments, network activity, and security telemetry for suspicious or anomalous behavior.
Conduct initial cybersecurity incident investigations and document findings using established procedures.
Validate alerts for accuracy and escalate advanced incidents when appropriate.
Monitor the health and availability of security monitoring components and identify connectivity or reporting issues.
Validate successful log ingestion and identify missing or delayed log sources affecting security visibility.
Use dashboards, visualizations, and reporting capabilities to identify security trends and operational anomalies.
Assist in validating the effectiveness of existing security detections and alerting capabilities.
Validate Linux logging requirements and security event collection for supported technologies.
Create and maintain Standard Operating Procedures (SOPs), investigation guides, and technical documentation for cybersecurity operations.
Participate in routine health checks of cybersecurity monitoring platform components supporting Network Monitoring Center operations.
Collaborate with Cyber Security Engineers II and III during advanced incident investigations and cybersecurity initiatives.
Support cybersecurity incident response activities as required.