Cybersecurity Engineer

National Laboratory of the Rockies

9d•$83,600 - $180,700•Remote

About The Position

The Cybersecurity Engineer manages, troubleshoots, and tunes cybersecurity tools and sensors, including SIEM, SOAR, analysis, enrichment, alerting, and forensic data-retention systems. The role selects, tests, deploys, and tunes on-premises and cloud-based environments that support infrastructure visibility, analysis, automation, and secure data retention. It guides security policy decisions and manages policies and configurations for distributed security tools such as firewalls, endpoint detection and response suites, vulnerability-detection tools, and cloud-based monitoring, protection, and incident-response tools. The engineer develops workflows, integrations, and automated tasks so cybersecurity personnel can use existing tools effectively. The position leads and performs infrastructure, application, and network tests and exercises; leads project teams integrating security products with enrichment, analysis, and system-management platforms; and creates and maintains architectural documentation and operational procedures. It also leads projects to improve the efficiency and effectiveness of NLR’s cybersecurity program, including workflow improvements, expanded automation, management-tool enhancements, strategic initiatives, and user-awareness training. This is a remote, regular position scheduled for 40 hours per week. Candidates must be able to obtain and maintain a DOE L/Q security clearance and a federal PIV card, including a favorable background investigation. Employment is contingent on meeting the stated educational requirements before the start date and passing a pre-employment drug test. The position is covered by DOE access restrictions and NLR’s drug-free workplace policy.

Requirements

Relevant bachelor's degree and at least 9 years of experience, or relevant master's degree and at least 7 years of experience, or relevant Ph.D. and at least 4 years of experience; equivalent relevant education and experience may qualify.
Must meet educational requirements before the employment start date.
Extensive information-systems expertise in a specific field and full knowledge of related disciplines.
Excellent leadership and project-management skills.
Skill in analytical techniques, practices, and problem solving.
Extensive programming and architecture abilities with computer software programs and information systems.
Splunk administration-specific experience or training/certifications.
Must be able to obtain and maintain a DOE L/Q Security Clearance; U.S. citizenship is required except in very limited circumstances, and candidates must be at least 18 years old to obtain a clearance.
Must be able to obtain and maintain a federal Personal Identity Verification (PIV) card, including a favorable background investigation.
Must pass a pre-employment drug test.

Nice To Haves

At least seven years in an IT role specifically in security engineering, or in a role that includes significant security-engineering work such as tool selection, installation, and maintenance.
One or more professional security and/or systems-engineering certifications, such as GIAC (SANS), Security+, or CISSP, or training demonstrating effort toward future certification.
Technical background across multiple disciplines, including Windows and Linux server and workstation administration; TCP/IP networking; Bash command-line expertise; network protocols and architecture; and security measures and defense in depth.
Experience managing and troubleshooting network- and host-based security tools and significant infrastructure, such as SIEM, IDS, IPS, and full packet capture, in a live production environment.
Cybersecurity-engineering subject-matter expertise, including selecting and tuning tools to provide analysts with valuable visibility and response capabilities.
Experience with common cybersecurity concepts and threats and explaining them to others.
Intermediate scripting or programming ability, preferably Python, in support of security orchestration and automation.
Splunk SIEM and Cortex XSOAR (formerly Demisto) technology-specific experience, training, or certifications.
Understanding of cloud security architecture, event collection, and aggregation.

Responsibilities

Manage, troubleshoot, and tune cybersecurity tools and sensors, including log aggregation (SIEM), automation and orchestration (SOAR), analysis, enrichment, alerting, and forensic data-retention systems.
Select, test, deploy, and tune on-premises and cloud-based technical environments supporting infrastructure visibility, analysis, automation, and secure data retention.
Guide security-policy decisions and manage security policies and configurations for distributed tools, including firewalls, endpoint detection and response suites, vulnerability-detection tools, and cloud-based monitoring, protection, and incident-response tools.
Develop workflows, integrations, and automated tasks that help cybersecurity personnel take advantage of existing tool capabilities.
Lead, design, and perform infrastructure, application, and network tests and exercises to assess security defense strategies and tools.
Lead Information Technology Services project teams integrating distributed network and endpoint security products with cybersecurity enrichment and analysis platforms and system-management tools.
Create and maintain architectural documentation and operational procedures describing the scope, purpose, configuration, use, and maintenance of cybersecurity operations tools and environments.
Lead assigned or independent projects that improve the effectiveness and efficiency of NLR’s cybersecurity program, including workflow improvements, automation expansion, management-tool enhancements, strategic initiatives, and user-awareness training.
Evaluate new hardware, software, systems tools, and applications and make procurement recommendations.

Benefits

Medical, dental, and vision insurance.
Short- and long-term disability insurance.
Pension benefits.
403(b) Employee Savings Plan with employer match.
Life and accidental death and dismemberment (AD&D) insurance.
Personal time off (PTO) and sick leave.
Paid holidays.
Tuition reimbursement, subject to eligibility; limited-term positions are not eligible.
Potential eligibility for performance-, merit-, and achievement-based awards with a monetary component; awards are not guaranteed.
Some positions may be eligible for relocation expense reimbursement.