Cybersecurity Infrastructure - Lead

General Dynamics Information Technology•USA FL MacDill AFB - 7115 S Boundary Blvd (FLC096), FL

1d•$144,500 - $195,500•Onsite

About The Position

GDIT is hiring a Cybersecurity Infrastructure Lead to provide cyber technical support for the Cyber Security Operations Center (CSOC). The role configures, tunes, optimizes, and maintains critical security infrastructure to protect digital assets from evolving cyber threats. It oversees the operation, architecture alignment, and maintenance of enterprise firewalls and boundary controls; Cloud-Based Internet Isolation (CBII) and Remote Browser Isolation (RBI) platforms; Security Onion-based IDS/IPS using Suricata and Zeek; Gigamon packet brokers and visibility fabrics; Splunk SIEM; EDR systems; NAC policies; and SOAR platforms. The position is on-site at MacDill Air Force Base in Tampa, Florida, and requires U.S. citizenship and an active TS/SCI clearance. The role involves infrastructure engineering and administration, operational support and troubleshooting, compliance and policy development, integration of detection tools with SOAR, documentation, and training and mentoring CSOC analysts. The position is scheduled for 40 hours per week, with less than 10% travel required.

Requirements

At least 5 years of experience in cybersecurity infrastructure administration and engineering.
Bachelor’s degree in Information Systems, Computer Science, Computer Engineering, Cybersecurity, or a related field; relevant work experience may be considered in lieu of a degree.
Applicable DoD 8140 or DoD 8570 certification, such as Security+ CE, CySA+, CASP+, CISSP, or a relevant CSSP role certification.
Active TS/SCI clearance; the posting also states the candidate must currently possess and be able to obtain TS/SCI.
U.S. citizenship.
Hands-on experience configuring and managing next-generation firewalls and boundary security policies.
Experience administering CBII and web proxy solutions.
Experience deploying, tuning, and operating Security Onion IDS/IPS sensors and managing Gigamon hardware or virtual TAPs.
Experience configuring and managing SIEM, EDR, NAC, and SOAR platforms.
Proficiency with Linux environments, including RHEL and Ubuntu/Debian, system administration, package management, and Bash or Python scripting for automation and log pipeline customization.
Strong knowledge of TCP/IP, packet analysis, traffic aggregation, filtering, and flow distribution using packet brokers and TAP infrastructure.
Hands-on expertise with Security Onion architecture, Suricata signature tuning, Zeek network analysis, and sensor deployment.
Knowledge of NGFW rule-base management, NAT policies, SSL/TLS inspection, and perimeter access controls.
Experience with CBII or Secure Web Gateways to protect users from web-borne threats.
Understanding of cybersecurity principles, the MITRE ATT&CK framework, threat vectors, and detection engineering practices across perimeter, network, and endpoint tools.
Strong analytical and troubleshooting skills for packet drops, network routing, sensor capture, and tool pipeline performance issues.
Excellent communication and collaboration skills; ability to work independently, prioritize high-impact operational tasks, and meet critical deliverables in a dynamic CSOC environment.

Nice To Haves

Prior CENTCOM or other Combatant Command operational environment experience.
Vendor-specific certifications, such as Gigamon Certified Professional, Palo Alto PCNSE, or Fortinet NSE, or Security Onion training.
Splunk Enterprise Certified Admin or Power User certification.
Practical experience in threat hunting, network traffic analysis including PCAP analysis and Wireshark, or CSOC analyst roles.
Deep experience hardening systems against DISA STIGs in DoD TS/SCI enclaves.

Responsibilities

Configure, manage, audit, and optimize enterprise firewalls, boundary defenses, rule sets, NAT policies, SSL/TLS inspection, and ingress/egress filtering.
Administer and optimize CBII and secure web gateway policies and workflows.
Deploy and maintain Gigamon TAPs and packet broker fabrics; aggregate, filter, deduplicate, and route network traffic to inspection tools.
Deploy and maintain Security Onion sensor grids; tune Suricata rules and Zeek parsing scripts to improve threat visibility and reduce false positives.
Deploy, configure, and maintain Splunk SIEM environments, queries, dashboards, and correlation alerts.
Tune EDR policies, sensor configurations, and scanning parameters, and enforce NAC policies to limit unauthorized device connectivity.
Ingest and normalize firewall, Gigamon, Security Onion, CBII, and endpoint telemetry in SIEM and central monitoring systems.
Perform preventative maintenance, software and firmware upgrades, OS patching, and performance tuning across security infrastructure.
Monitor throughput, TAP drop rates, sensor health, and resource utilization to maintain network visibility.
Provide escalation support and troubleshoot operational incidents affecting boundary protections, isolation sessions, and sensor pipelines; coordinate with vendors when needed.
Audit and assess security tools for vulnerabilities, implement corrective remediation, and apply hardening benchmarks such as DISA STIGs.
Prepare technical briefings and operational capability demonstrations for CSOC and program leadership.
Develop and maintain SOPs, configuration baselines, security policies, architecture diagrams, engineering documentation, and operational runbooks.
Collaborate with audit and compliance teams to support FISMA and DoD compliance requirements and RMF controls.
Integrate network detection platforms with SOAR to support automated enrichment, dynamic IP blocking, and containment workflows.
Design, implement, and maintain SOAR playbooks to accelerate CSOC triage of high-fidelity alerts.
Train and mentor CSOC Tier 1/2 analysts in querying Zeek metadata, evaluating Suricata alerts, and interpreting isolation-session telemetry.
Collaborate and share knowledge across the cybersecurity engineering team.