Cybersecurity Engineer

Georgia Department of Revenue•Atlanta, GA

2d•$76,822 - $110,000•Remote

About The Position

The Cybersecurity Engineer serves as DECAL’s lead technical resource for Security Operations Engineering and cybersecurity monitoring technologies. The role engineers, administers, and continuously improves security operations capabilities, including security monitoring, threat detection, cybersecurity automation, incident response coordination, vulnerability and exposure management, and assigned security operations technologies. The position provides technical leadership for Microsoft Sentinel, Microsoft Defender, detection engineering, threat hunting, vulnerability management, email security technologies, and cybersecurity incident response. It works with Governance, Risk and Compliance, Legal, IT Operations, Application Development, and business stakeholders to improve security visibility, operational readiness, and cybersecurity maturity. The role also provides technical mentoring and guidance without direct supervisory responsibility, supports compliance and audit activities, and helps develop operational standards and documentation. The position is headquarters-based in Atlanta, Georgia, and identified as remote. Work is typically performed in an office or remote-work environment, with intermittent sitting, standing, or walking. The role requires close visual acuity and hand and finger motion for computer-based work, along with the ability to communicate clearly and understand conversational speech.

Requirements

Bachelor’s degree in Computer Science, Information Technology, Information Security, or a related field, or equivalent experience.
Four years of proven experience and demonstrated success in technology leadership, emphasizing information security and data governance.
Currently hold an advanced-level cyber certification under state guidelines, or obtain one within 12 months of the start date: CISSP, CISA, CISM, GCIH, GCED, or GSLC.
Must hold or be able to qualify for a U.S. Department of Homeland Security clearance.
Be well organized, efficient, and able to work independently on own initiative.
Work effectively as part of a lean, collaborative team.
React calmly, quickly, and efficiently under pressure.
Have strong written and verbal communication skills for reporting to management and other stakeholders.
Demonstrate the ability to lead technical work, mentor others, and document repeatable processes.
Demonstrated experience supporting, administering, engineering, securing, or connecting cybersecurity technologies across security operations, monitoring, threat detection, vulnerability management, email security, automation, and incident response.

Nice To Haves

Experience as a senior engineer, technical lead, subject matter expert, or mentor in a Security Operations environment.
Hands-on experience with approximately 50% or more of the listed technologies and capabilities, particularly Microsoft Sentinel and Microsoft Defender.
Experience with security monitoring, detection engineering, MITRE ATT&CK mapping, threat hunting, IOC analysis, incident response, vulnerability management, email security administration, KQL, scripting, and security orchestration.
Understanding of cybersecurity and compliance frameworks such as NIST SP 800-53, CJIS Security Policy, IRS Publication 1075, FedRAMP, GovRAMP, state cybersecurity standards, or similar control-based environments.
Industry certifications such as SC-200, AZ-500, SC-100, CISSP, CISM, or equivalent.
Experience with technologies and capabilities such as Microsoft Sentinel; Microsoft Defender products; Azure security services; Microsoft Entra ID; EOP and Barracuda Email Security; KQL; PowerShell, Python, or another scripting language; APIs and security connectors; SIEM/XDR; threat intelligence; cloud security posture management; and monitoring or telemetry ingestion for AWS, GCP, ServiceNow, Salesforce, or other enterprise platforms.

Responsibilities

Lead administration, configuration, optimization, and continuous improvement of security operations platforms and services.
Engineer and maintain security monitoring, threat detection, automation, and response capabilities.
Configure and optimize security data sources, telemetry collection, connectors, and monitoring integrations.
Develop and optimize analytics rules, alerts, dashboards, workbooks, automation workflows, and response playbooks.
Manage security telemetry collection, event correlation, and monitoring visibility across security and enterprise platforms.
Develop scripting and automation solutions to improve operational efficiency, detection, and response.
Improve monitoring coverage, operational effectiveness, and Security Operations maturity.
Develop, tune, and maintain threat detections, monitoring use cases, analytical content, and MITRE ATT&CK-aligned detection coverage.
Conduct threat hunting, IOC analysis, and advanced security investigations; analyze threat intelligence, attack techniques, and security events.
Perform root cause analysis and use lessons learned to improve monitoring and response capabilities.
Lead technical vulnerability and exposure management activities across the enterprise, including managing Defender Vulnerability Management, Azure Secure Score, Defender for Cloud recommendations, remediation tracking, and posture reporting.
Coordinate with infrastructure, application, and business teams to prioritize and address security findings; validate remediation and support technical recommendations and compensating controls.
Lead and organize cybersecurity investigations and incident response, coordinating technical response, evidence collection, containment, eradication, and recovery support.
Maintain incident documentation, facilitate after-action reviews, and improve operations based on lessons learned; serve as an escalation resource for complex events.
Administer email security technologies, including EOP, Microsoft Defender for Office 365, and Barracuda Email Security; investigate phishing, malware, business email compromise, and related events.
Develop and maintain email security monitoring, detection, and response capabilities.
Mentor, train, and guide cybersecurity personnel and future Security Operations staff without direct supervisory responsibility.
Develop operational standards, runbooks, procedures, and knowledge-sharing materials.
Support governance, compliance, audit, and risk management through technical implementation, documentation, evidence collection, remediation support, and subject matter expertise.
Participate in security reviews for new technologies and define monitoring, detection, logging, vulnerability management, and incident response requirements.
Provide backup coverage for Microsoft Purview capabilities through cross-training and documented procedures.
Participate in cross-training and continuity efforts, support cybersecurity awareness and operational readiness initiatives, and perform other duties as assigned.

Benefits

15 vacation days each year, increasing according to years of service (up to five years of service).
15 days of sick leave each year.
13 paid state holidays.
Retirement benefits, including a 401(k) plan with an employer match and a defined benefit pension plan.
Health insurance.
Dental insurance.
Vision insurance.
Legal insurance.
Disability insurance.
Healthcare and childcare spending accounts.
Life and dependent life insurance.