Cyber Security Engineer

Seneca Holdings•Orlando, FL

4d•Onsite

About The Position

Seneca Technologies, part of the Seneca Nation Group portfolio, is seeking a Cyber Security Engineer I to support Security Operations Center (SOC) operations in Orlando, Florida. The role monitors, investigates, and responds to cybersecurity events across enterprise Linux environments using Security Information and Event Management (SIEM) technologies. The engineer works collaboratively with cybersecurity engineers and operational teams to help maintain the availability, integrity, and effectiveness of cybersecurity monitoring capabilities supporting mission-critical operations in a Department of Defense environment.

Requirements

Active Top Secret/Sensitive Compartmented Information (TS/SCI) security clearance.
Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related technical field.
At least 3 years of relevant professional experience supporting cybersecurity operations, network monitoring, enterprise Linux environments, or equivalent technical disciplines; equivalent combinations of education, certifications, military service, and relevant experience will be considered.
Experience performing cybersecurity alert monitoring and incident investigations.
Experience supporting enterprise Linux environments.
Experience using enterprise monitoring or SIEM technologies.
Experience documenting investigative findings using ticketing, case management, or equivalent systems.
Ability to analyze and interpret security events to identify suspicious or malicious activity.

Nice To Haves

Active Security+, CySA+, or equivalent cybersecurity certification meeting applicable Department of Defense cybersecurity workforce requirements is highly preferred.
Linux+ or Elastic Certified SIEM Analyst certification.
Experience using enterprise SIEM technologies such as Elastic, Splunk, or equivalent technologies.
Experience monitoring enterprise Linux environments, network security events, and cybersecurity telemetry.
Familiarity with MITRE ATT&CK methodologies and cybersecurity frameworks.
Experience using Jira, Confluence, or comparable collaboration platforms.
Experience supporting cybersecurity operations in Government, Department of Defense, or enterprise environments.
Familiarity with cybersecurity incident response processes and investigative methodologies.
Experience developing dashboards, visualizations, and reporting capabilities for cybersecurity operations.
Experience supporting Elastic Security, Elastic Observability, Elastic Agents, or Logstash is highly desired.

Responsibilities

Continuously monitor security alerts and operational anomalies using enterprise SIEM technologies in support of SOC operations.
Analyze, triage, and investigate security events generated by enterprise monitoring and security platforms.
Monitor enterprise Linux environments, network activity, and security telemetry for anomalous or suspicious behavior.
Conduct initial cybersecurity incident investigations and document findings using established procedures.
Validate alerts for accuracy and escalate advanced incidents when appropriate.
Monitor the health and availability of security monitoring components and identify connectivity or reporting issues.
Validate successful log ingestion and identify missing or delayed log sources that affect security visibility.
Use dashboards, visualizations, and reporting capabilities to identify security trends and operational anomalies.
Assist in validating the effectiveness of existing security detections and alerting capabilities.
Validate Linux logging requirements and security event collection for supported technologies.
Create and maintain standard operating procedures, investigation guides, and technical documentation for cybersecurity operations.
Participate in routine health checks of cybersecurity monitoring platform components supporting Network Monitoring Center operations.
Collaborate with Cyber Security Engineers II and III on advanced incident investigations and cybersecurity initiatives.
Support cybersecurity incident response activities as required.