Cyber Security Engineer

Election Systems & Software•Omaha, NE

About The Position

A Cyber Security Engineer at ES&S designs, implements, maintains, and improves enterprise cybersecurity technologies and controls that protect the organization’s systems, networks, applications, and data. The role serves as a technical security resource supporting security monitoring, threat detection, incident response, vulnerability management, security architecture, and the development and maintenance of cybersecurity policies and standards. The role involves working with Microsoft Azure security services, Microsoft Sentinel, Microsoft Defender XDR, Splunk Enterprise Cloud, and potentially Cisco XDR security technologies. It also supports governance, risk, and compliance activities, including security assessments, risk documentation, control recommendations, policy and standards maintenance, and risk remediation tracking. Up to 10% travel is anticipated.

Requirements

At least 3 years of progressive cybersecurity experience.
Hands-on experience administering and configuring Microsoft Sentinel in Microsoft Azure.
Experience with Data Collection Rules, Log Analytics Workspaces, Azure Monitor Agent, and Logic Apps.
Experience configuring Sentinel data connectors and onboarding Syslog, CEF, API, and custom log data sources.
Experience creating DCR transformations and custom tables, and managing security telemetry ingestion and storage.
Experience creating Sentinel Workbooks and strong working knowledge of KQL.
Hands-on experience supporting and administering Microsoft Defender XDR, including threat investigation and response.
Experience using Advanced Hunting and KQL across endpoint, identity, email, and cloud-service telemetry.
Experience with exposure and vulnerability management, including identifying, tracking, and prioritizing vulnerabilities and CVEs.
Experience onboarding Windows endpoints and servers into Microsoft Defender for Endpoint and troubleshooting sensor health and connectivity.
Working knowledge of Attack Surface Reduction rules and experience tuning or suppressing alerts.
Hands-on experience with Splunk Enterprise Cloud and onboarding data sources.
Experience managing Splunk data inputs, including HTTP Event Collector, and working knowledge of indexes, source types, and data ingestion.
Fundamental knowledge of Splunk Search Processing Language (SPL).
Experience validating and troubleshooting Splunk ingestion, parsing, indexing, and source-type assignments.
Working knowledge of information security principles, including the CIA triad, and ability to apply them in security and risk assessments.
Experience performing information security assessments, documenting risks, and recommending controls and remediation.
Working knowledge of the NIST Cybersecurity Framework and risk management principles.
Knowledge of security lifecycle risks associated with aging technologies, end-of-life systems, unsupported software, and compensating controls.
Familiarity with NIST CSF, NIST SP 800-series guidance, CIS Controls, and ISO/IEC 27001.
Ability to translate technical security findings into business risk and document impact, likelihood, remediation, compensating controls, and residual risk.
Experience supporting risk registers, security exceptions, risk acceptance, remediation tracking, and security control assessments.

Nice To Haves

Experience using Microsoft Sentinel with Microsoft Defender XDR’s unified security operations experience.
Hands-on experience with Cisco XDR, including integrating security products and investigating detections.
Working knowledge of Cisco Umbrella SIG and Cisco Secure Access.
Understanding of SSL/TLS inspection, certificate-based decryption, policy exclusions, certificate trust issues, and troubleshooting encrypted traffic inspection.
Understanding of Remote Browser Isolation and its use in reducing risk from untrusted web content.
Experience troubleshooting security integrations and validating telemetry flow from Cisco and third-party security platforms.

Responsibilities

Design, implement, maintain, and improve enterprise cybersecurity technologies and controls.
Support security monitoring, threat detection, incident response, vulnerability management, and security architecture.
Develop and maintain cybersecurity policies and standards.
Administer and configure Microsoft Sentinel, including data collection, connectors, transformations, workbooks, and data ingestion and storage.
Use Kusto Query Language (KQL) for security data analysis, troubleshooting, reporting, and threat hunting.
Support Microsoft Defender XDR incident and alert management, investigations, response, endpoint onboarding, and containment.
Configure and manage Splunk Enterprise Cloud data inputs and create and schedule searches and reports.
Support Cisco XDR investigations and integrations, and troubleshoot Cisco security technologies and telemetry flows when applicable.
Perform information security assessments, identify security gaps, document risks, and recommend controls and remediation activities.
Support risk registers, security exceptions, risk acceptance, remediation tracking, and security control assessments.
Apply security frameworks and risk management principles when developing, reviewing, and maintaining information security policies and standards.
Translate technical security findings into business risk, including impact, likelihood, remediation recommendations, compensating controls, and residual risk.
Travel up to 10%.