Cybersecurity Security Engineer

SOSi•Aiea, HI

5h•$124,512 - $168,091

About The Position

SOSi is seeking a Cyber Security Engineer to architect, integrate, and evolve the security ecosystem for a mission-critical Command and Control (C2) enterprise serving more than 5,000 users across the INDOPACOM theater. The role brings together SIEM, SOAR, and Linux automation technologies to deliver actionable telemetry, automated security outcomes, and real-time risk visibility, while advancing Zero Trust cybersecurity and cyber resilience. The engineer works alongside engineers, SOC operators, and senior government leaders. The position covers Zero Trust engineering; SIEM design, deployment, tuning, and data pipeline engineering; SOAR platform integration and playbook development; endpoint security and EDR; vulnerability management; Linux infrastructure, patching, and compliance automation; and cybersecurity compliance, risk, and reporting. The role also supports mission operations and engages with vendors, other agencies, and coalition partners.

Requirements

Active, in-scope Top Secret clearance with SCI eligibility and a valid U.S. passport.
Bachelor's degree in Cyber Security, Computer Science, Information Systems, Computer Engineering, or a related field and at least 5 years of experience, or at least 9 years of cybersecurity engineering experience in a DoD or classified environment.
At least 3 years of hands-on engineering experience—deploying, tuning, and integrating, not only operating—with at least three of the following: SIEM (Elastic preferred), SOAR, security data pipelines, EDR, enterprise vulnerability management, and Linux configuration and patch management.
DoD 8570 IAT-II-compliant certification: Security+ CE, CCNA, CND, CySA+, GICSP, GSEC, or SSCP.
Working knowledge of Zero Trust concepts, the DoD Zero Trust Reference Architecture, and tiered or privileged access models.
Administration skills in Linux and Windows Server, including Active Directory, Kerberos, PKI, and DNS fundamentals.
Experience implementing STIGs and SRGs, SCAP scanning, and RMF documentation in DoD environments.
Scripting or automation experience with at least one of Python, PowerShell, Bash, or Ansible, including REST API integrations.
Clear written and verbal communication skills, including the ability to brief technical topics to senior leadership.

Nice To Haves

Hands-on engineering experience across all listed capability areas, including building SOAR playbooks in production.
Elastic certifications, such as Elastic Certified Engineer or Analyst, and vendor certifications for the SOAR, EDR, data pipeline, or vulnerability management platforms in use.
Red Hat certifications (RHCSA or RHCE) and experience with Linux identity management integrated with Active Directory trusts.
Experience designing detections with MITRE ATT&CK and building SOC workflows and metrics.
Experience with privileged access workstations (PAWs), tiered or ESAE-style administration, and phishing-resistant MFA (CAC/PIV).
Familiarity with Data Centric Security, NSA CSfC capability packages, and Cross Domain Solutions (CDS).
Experience with virtualization and hyperconverged platforms from a security-hardening perspective.

Responsibilities

Assess, design, and maintain a roadmap for security capabilities aligned with the DoD Zero Trust Reference Architecture and Target-level activities across all seven pillars.
Translate Zero Trust requirements into configurations, segmentation rules, and policies, and document control mappings to the architecture.
Evaluate, pilot, and integrate security technologies to address Zero Trust capability gaps.
Design, deploy, and tune SIEM security, including agent policies, integrations, index lifecycle management, data tiers, and cluster sizing.
Engineer security data pipelines to collect, filter, enrich, and normalize data to a common schema before it enters the SIEM, managing data volume and cost.
Develop, test, and tune detection rules, dashboards, and alerts mapped to MITRE ATT&CK, and reduce false positives in partnership with the SOC.
Design, deploy, and maintain the SOAR platform and integrate it with SIEM, endpoint, vulnerability, identity, network, and ticketing systems.
Build and test SOAR playbooks for alert triage, enrichment, containment, and case management, including human approval gates where required.
Support the Automation and Orchestration pillar of the DoD Zero Trust strategy, including policy decision and enforcement integration.
Engineer and harden enterprise endpoint protection and EDR platforms, including DoD-mandated endpoint security solutions, policies, host intrusion prevention, and device control.
Maintain endpoint agent health, deployment coverage, and policy compliance across Windows and Linux endpoints, and forward endpoint telemetry to the SIEM.
Operate and optimize enterprise vulnerability scanning in line with DoD requirements, including ACAS where applicable, credentialed scan design, scan zones, and reporting.
Drive vulnerability remediation by correlating findings with asset owners and patch status, tracking IAVM compliance, and producing risk-based remediation priorities.
Engineer, build, and maintain enterprise Linux server infrastructure, including hardened builds, identity integration, performance, availability, upgrades, and lifecycle replacement.
Engineer Linux content lifecycle, patching, and errata workflows to deliver timely, tested updates across environments.
Automate STIG and SCAP compliance using configuration-as-code and report compliance status to leadership.
Implement and validate STIGs and SRGs, and produce RMF artifacts, POA&Ms, and assessment and inspection evidence, such as for CORA.
Interact with vendors, other agencies, and coalition partners on behalf of the program.
Contribute to After Action Reports (AARs) and submit Weekly Activity Reports (WARs) according to contract requirements.