Cybersecurity Engineer 4 – Splunk SIEM

Ryan Consulting Group•Columbus, OH

2d•Onsite

About The Position

Ryan Consulting Group, Inc. is seeking a Cybersecurity Engineer to provide cybersecurity engineering, administration, and operational support for the Defense Logistics Agency (DLA). The role maintains Splunk Core and Splunk Enterprise Security (ES) infrastructure, develops customized security dashboards and correlation searches, and supports enterprise security monitoring and incident response operations. This position is onsite at a DLA facility in Columbus, Ohio, or Richmond, Virginia. The schedule is Monday through Friday during standard business hours between 6:00 a.m. and 6:00 p.m. local time. Travel is approximately six trips annually, with each trip lasting four days, between Washington, D.C., Columbus, and Richmond. Employment offers are conditional on the award of the contract; recruitment may be modified, delayed, or canceled based on the award outcome.

Requirements

At least seven years of relevant IT cybersecurity experience, preferably within the federal government.
Hands-on experience integrating, administering, and sustaining Splunk Core and Splunk Enterprise Security (ES) environments.
Experience creating customized Splunk dashboards and reports using security threat data.
Experience developing and maintaining Splunk ES correlation searches, security rules, and monitoring capabilities.
Experience supporting Splunk infrastructure upgrades, maintenance, troubleshooting, and enterprise log management.
Active Top Secret (TS) security clearance at the time of proposal submission.
Meet both Department of Defense Cyber Workforce Framework (DCWF) qualifications at the Intermediate level: Primary DCWF 521 – Cyber Defense Infrastructure Support Specialist and Secondary DCWF 451 – System Administrator. Each qualification may be satisfied through an approved education, training, or certification pathway.
Work onsite at the DLA facility in Columbus, Ohio, or Richmond, Virginia, and be available for required travel.
Hold a Splunk Administrator certification at the time of submission.

Nice To Haves

Federal government cybersecurity experience is preferred.
A bachelor's degree in Information Technology, Cybersecurity, Computer Science, Information Systems, Data Science, or Software Engineering may satisfy the education pathway for both DCWF roles.
Qualifying training or certifications may satisfy the DCWF requirements. Certifications recognized under both roles include CompTIA Security+, CompTIA Cloud+, GIAC Security Essentials (GSEC), and Systems Security Certified Practitioner (SSCP); a single qualifying certification may satisfy both roles.

Responsibilities

Administer, maintain, and support Splunk Core and Splunk Enterprise Security (ES) infrastructure.
Develop and customize Splunk ES correlation searches, security rules, dashboards, reports, and data monitors to identify potential threats and support incident response.
Analyze security logs, intrusion detection system (IDS) data, threat intelligence reports, vendor information, and other security data sources.
Maintain Splunk ES backend infrastructure, including upgrades, troubleshooting, daily maintenance, and operational support.
Research, plan, install, configure, troubleshoot, maintain, and back up components of the DLA Splunk Enterprise Log Management (ELM) architecture.
Develop security monitoring use cases, active channels, and trend analysis capabilities to improve threat identification and data mining.
Provide security analysis and recommendations to support Computer Emergency Response Team (CERT) Incident Handlers and Information Assurance Managers (IAM).
Support cybersecurity engineering activities involving the planning, design, development, testing, demonstration, and integration of information systems.
Apply analytical and systematic approaches to resolving cybersecurity-related technical and operational challenges.