Cybersecurity Engineer 3

TOMORROW HIRE•Richmond, VA

2d•Onsite

About The Position

We are seeking an experienced Cybersecurity Engineer to strengthen the agency's cybersecurity operations by developing and implementing advanced cyber defense solutions. This role is responsible for safeguarding enterprise infrastructure, supporting Splunk SIEM operations, detecting and responding to cyber threats, and ensuring security solutions are implemented according to agency standards. The ideal candidate is a highly analytical security professional with deep experience in SIEM operations, threat detection, incident response, and security monitoring. The Cybersecurity Engineer will support VDOT's cybersecurity operations by leveraging Splunk Enterprise Security to monitor, detect, investigate, and respond to cybersecurity threats across enterprise environments. This position works closely with infrastructure, networking, and IT teams to improve detection capabilities, onboard new log sources, develop threat detection use cases, and support security compliance initiatives while protecting critical systems and data.

Requirements

Minimum of 8 years of hands-on cybersecurity experience operating, building, and investigating threats within SIEM or Splunk environments.
Minimum of 8 years of experience writing and optimizing SPL (Splunk Processing Language).
Minimum of 8 years of experience with networking concepts, firewalls, endpoint detection and response (EDR), and cloud platforms such as AWS, Azure, or GCP.
Minimum of 8 years of experience applying security frameworks and compliance standards such as MITRE ATT&CK, NIST, HIPAA, or SOC 2.
Minimum of 8 years demonstrating excellent critical thinking, problem-solving, communication, and the ability to manage multiple security incidents under pressure.
Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field.
Must physically reside within the United States for the duration of the assignment.
Must attend an in-person interview.
Must be legally authorized to work in the United States without employer sponsorship, now or in the future.

Nice To Haves

Minimum of 8 years of experience supported by Splunk certifications such as Splunk Core Certified User and Splunk Core Certified Advanced Power User.

Responsibilities

Continuously monitor network traffic, endpoint activity, cloud environments, and security logs for suspicious behavior and potential security incidents.
Perform proactive threat hunting using Splunk Enterprise Security and advanced analytical techniques.
Identify, analyze, and prioritize security events requiring investigation.
Create, maintain, optimize, and tune Splunk correlation searches, dashboards, alerts, and detection rules.
Develop efficient SPL (Splunk Processing Language) queries to improve threat detection and reduce false positives.
Support onboarding, parsing, normalization, and validation of new log sources within the SIEM platform.
Investigate security incidents and analyze forensic evidence to determine root cause and impact.
Collaborate with infrastructure, networking, and IT teams to contain, remediate, and recover from cybersecurity events.
Document findings and contribute to continuous improvement of incident response procedures.
Develop and enhance detection use cases and response playbooks using threat intelligence and security frameworks such as MITRE ATT&CK.
Support implementation of advanced cyber defense capabilities that strengthen enterprise security posture.
Recommend improvements to monitoring, detection, and response processes.
Generate security reports and SIEM metrics supporting audit readiness.
Collect and maintain evidence required for security and compliance reviews.
Support compliance efforts aligned with recognized security standards and internal policies.