Defensive Cybersecurity Engineer/SOC SME

The Mitre Corporation•Tampa, FL

19h•$158,800 - $238,200•Onsite

About The Position

MITRE’s Defensive Cyber Operations department seeks a cybersecurity professional to support government sponsors’ mission-driven cybersecurity initiatives. The role provides subject matter expertise on enterprise security operations centers (SOCs), including daily operations, governance, and process improvement. It translates defensive cybersecurity concepts into practical training tailored to sponsors’ environments and develops hands-on scenarios reflecting real-world challenges and mission needs. The position applies MITRE ATT&CK® to threat hunting and defense development; designs and refines detections, analytics, and dashboards; integrates data sources into SIEM platforms; and evaluates threat-hunting methodologies. It also researches practical, cost-effective applications of AI techniques in SOC operations, assesses SOC capabilities and gaps, and validates detections and defensive workflows through testing and exercises. The position requires at least three days per week on-site and travel of up to 25%, including to international customer locations.

Requirements

Typically requires at least 8 years of related experience with a bachelor’s degree, 6 years with a master’s degree, or 3 years with a Ph.D., or an equivalent combination of education and work experience.
At least 3 years of operational experience.
Bachelor’s degree in Computer Science, Cybersecurity, Data Science, Applied Mathematics, Statistics, or a related field.
Experience leveraging common SOC tools to defend an enterprise environment.
Demonstrated experience conducting proactive cyber threat hunting across enterprise environments.
Experience developing technical training content, curriculum, courseware, or other learning materials for cybersecurity audiences.
Strong technical writing, presentation, and facilitation skills.
Ability and willingness to travel up to 25% to deliver training at customer locations, including international locations.
Must be eligible to obtain and maintain a U.S. government Top Secret security clearance; U.S. citizenship is required for security-clearance eligibility.
Must work on-site at least 3 days per week.

Nice To Haves

Experience leading technical training sessions for government, partner, or other technical audiences.
Experience creating hands-on cybersecurity labs, exercises, or scenario-based learning materials.
Experience with Splunk or Elastic/ELK.
Comfort presenting to non-English-speaking audiences with translation support.
Experience applying MITRE ATT&CK to support cybersecurity operations.
Experience integrating AI-enabled workflows with cybersecurity platforms such as SIEM, SOAR, EDR/XDR, threat-intelligence, case-management, or cloud-security platforms.

Responsibilities

Provide government sponsors with subject matter expertise on enterprise SOC daily operations, governance, and process improvement.
Translate defensive cybersecurity concepts into practical training tailored to sponsor network topologies, staffing, funding, and technical resources.
Develop hands-on training scenarios and exercises reflecting real-world defensive cyber challenges and sponsor mission needs.
Apply MITRE ATT&CK® to guide threat hunting and develop defenses aligned with adversary tactics, techniques, and procedures.
Design, develop, and refine security detections, analytics, and dashboards, and integrate new data sources into SIEM platforms.
Develop, evaluate, and improve threat-hunting methodologies to identify adversary activity and strengthen defensive cyber capabilities.
Research and evaluate emerging AI techniques, including machine learning, deep learning, generative AI, and reinforcement learning, for practical and cost-effective SOC applications.
Assess SOC capabilities, identify operational and technical gaps, and recommend improvements aligned with sponsor priorities and available resources.
Validate detections and defensive workflows through testing and exercises, using results to improve detection coverage, reduce false positives, and refine operational procedures.