Vectra AI Integration Engineer, Mid

Booz Allen Hamilton•Reston, VA

About The Position

Booz Allen is seeking a Vectra AI Integration Engineer to deploy, tune, and sustain Vectra AI Detect sensors and Recall pipelines in physical data centers, air-gapped networks, and enterprise on-premise environments. The role focuses on network metadata, packet-level telemetry, routing, sensor placement, and integration with on-premise SOC tooling. The engineer will deploy and sustain sensors, collectors, and metadata pipelines; integrate Vectra AI with on-premise SIEM/SOAR/EDR, packet brokers, and analysis tools; and engineer physical and virtual sensor placement. The role also involves managing routing, VLANs, packet capture, and metadata transformation; supporting STIG-aligned configurations and secure baselines; building monitoring dashboards and sensor health checks; tuning performance; and coordinating with operations teams to ensure reliable telemetry ingestion and threat detection fidelity. Applicants must hold an active TS/SCI clearance and be willing to take a polygraph exam. The selected applicant will be subject to a security investigation and may need to meet eligibility requirements for access to classified information. The role requires the ability to obtain specified DoD 8570 certifications within 60 days and 30 days of the start date, respectively. The projected annualized compensation range is $69,400 to $158,000. Booz Allen describes its benefits as including health, life, disability, financial, and retirement benefits, paid leave, professional development, tuition assistance, work-life programs, dependent care, and recognition awards. Eligible employees working at least 20 hours per week on a regular basis may participate in benefit programs, with eligibility varying for employees below that threshold. Applicants should expect identity verification using biometrics and AI and should be on camera during interviews and assessments. AI tools may not be used to assist with interview responses unless explicitly permitted. The work model is not specified for this position; the posting describes the company’s general expectations for remote, hybrid, and onsite roles.

Requirements

At least 3 years of experience with on-premise network engineering or cybersecurity platforms.
Experience deploying Vectra AI or NDR platforms such as Corelight, Stellar, Cortex, Falcon, or RevealX in physical or virtual data center environments.
Experience with packet analytics tools such as Zeek, Suricata, Arkime, or Endace.
Experience with hardened OS builds, secure enclaves, access controls, and network segmentation.
Experience with Linux engineering and system operations.
Knowledge of TCP/IP, DNS, TLS, HTTP/S, NetFlow/IPFIX, packet capture, and metadata pipelines.
Active TS/SCI clearance and willingness to take a polygraph exam.
One of the following education and experience combinations: high school diploma or GED and 7+ years supporting IT projects and activities; associate degree and 5+ years; bachelor's degree and 3+ years; or master's degree and 1+ years.
Ability to obtain a DoD 8570 IAT Level III certification—such as SecurityX, CCNP Security, CISA, CISSP or Associate, GCED, GCIH, or CCSP—within 60 days of the start date.
Ability to obtain a DoD 8570 Cybersecurity Service Provider - Infrastructure Support (CSSP-IS) certification—such as CEH, CySA+, GICSP, SSCP, CHFI, CFR, Cloud+, or CND—within 30 days of the start date.

Nice To Haves

Experience integrating NDR telemetry into SOC pipelines in secure on-premise environments.
Experience in environments with strict access controls or Zero Trust requirements.
Experience with virtualization platforms, physical rack deployments, and packet brokers.
Experience with incident response and threat hunting based on raw network metadata.

Responsibilities

Deploy and sustain Vectra AI sensors, collectors, and metadata pipelines in on-premise networks.
Integrate Vectra AI with on-premise SIEM/SOAR/EDR, packet brokers, and analysis tools.
Engineer physical and virtual sensor placement, including SPANs, taps, packet brokers, and east-west segmentation visibility.
Manage routing, VLANs, packet capture, and metadata transformation.
Support STIG-aligned configurations and secure baselines consistent with on-premise operating guidance.
Build monitoring dashboards, sensor health checks, and performance-tuning workflows.
Coordinate with operations teams to ensure reliable on-premise telemetry ingestion and threat-detection fidelity.