26-1096: SEIM / Telemetry / Security Analytics Engineer - Herndon, VA

Navitas Business Consulting • Herndon, VA

5d • Onsite

About The Position

Navitas is an industry leader in the digital transformation space, serving as trusted advisors to clients in the commercial, federal, and state and local markets. At its core, Navitas is a group of problem solvers providing award-winning technology solutions to drive digital acceleration for customers. This role specifically focuses on providing SIEM/Telemetry/Security Analytics Engineering for USCIS, involving end-to-end security telemetry engineering, including log onboarding, parsing, normalization, detection content, dashboards, UEBA tuning, and SOAR playbook engineering. The engineer will operate and extend the agency's existing Splunk Enterprise Security and Swimlane SOAR stack to achieve measurable maturity progression for the Visibility & Analytics and Automation & Orchestration ZTMM pillars, working in close partnership with other Navitas pillar engineers.

Requirements

• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, EE, or related discipline (4 additional years of relevant experience may substitute).
• 5+ years hands-on SIEM/SOC detection engineering experience, with at least 3 years on Splunk Enterprise / Splunk Enterprise Security.
• Demonstrated ability to author and tune SPL searches, correlation searches, notable events, dashboards, and CIM-compliant data models.
• Experience integrating heterogeneous log sources across endpoint (EDR), identity (AD/Entra ID, ICAM stacks), network (firewall, NDR, NetFlow), cloud (AWS GovCloud, Azure), and applications.
• Hands-on experience with at least one SOAR platform — Swimlane (preferred), Splunk SOAR/Phantom, Cortex XSOAR, or Tines.
• Strong scripting skills in Python and/or PowerShell; familiarity with Bash, REST APIs, and Git.
• Working knowledge of MITRE ATT&CK, NIST SP 800-53 (AU, SI, IR, CA control families), and CISA Zero Trust Maturity Model 2.0.
• DoD 8570/8140 IAT-II baseline certification — Security+ CE, CySA+, GCIA, GCDA, GCIH, or CISSP — held or obtainable within 90 days of EOD.
• Effective written and verbal communication; ability to brief Government stakeholders at PMR cadence.

Nice To Haves

• Splunk certifications: Core Certified Power User / Admin, Enterprise Security Certified Admin, SOAR Certified Automation Developer.
• Advanced GIAC: GCDA, GCFA, GNFA, GCTI, GREM.
• Experience with telemetry pipeline / data-tiering tools: Cribl Stream, Snowflake, Databricks, OpenTelemetry.
• AWS Certified Security – Specialty; Microsoft SC-200 or AZ-500.
• Contributions to open-source detection projects (Sigma, Atomic Red Team, MITRE Caldera).
• Experience writing FedRAMP / FISMA continuous monitoring artifacts and ATO/cATO support.

Responsibilities

• Operate, tune, and extend the USCIS Splunk Enterprise Security deployment, including content engineering, data-model curation, accelerated dataset hygiene, and license/index optimization.
• Design and maintain Swimlane SOAR playbooks for high-volume alert classes to reduce MTTR and analyst toil.
• Author and version-control correlation searches mapped to MITRE ATT&CK techniques and CISA ZTMM Visibility & Analytics sub-capabilities.
• Lead log-source onboarding for new ZT capabilities (identity, device, network, app, data), defining CIM mappings, parsers, retention, and access controls.
• Build and operate UEBA detections, tune for low false-positive rates, and integrate UEBA risk scores into SOAR enrichment.
• Produce monthly ZTMM maturity evidence packets and PMR briefing materials.
• Partner with pillar leads for Devices, Identity, Networks, Apps/Workloads, and Data on cross-pillar enforcement chains and automated response.
• Support incident response, threat hunts, and on-call rotation as assigned.
• Direct USCIS or DHS-component experience with the existing Splunk Enterprise Security + Swimlane SOAR deployment.
• UEBA tuning experience (Splunk UBA, Exabeam, or equivalent).
• Detection-as-code / content-as-code experience: Sigma rules, Git-based content pipelines, automated testing of detections.
• Threat hunting using SPL/KQL, hypothesis-driven hunt playbooks, and ATT&CK coverage gap analysis.
• Cloud-native telemetry experience: AWS CloudTrail, GuardDuty, VPC Flow, Azure Sentinel/Monitor, Microsoft Defender XDR — at scale.
• Experience producing ZTMM Visibility & Analytics maturity progression evidence with quantified KPIs.
• Familiarity with TIC 3.0, EINSTEIN sensor data, CISA CDM Phase 4 (User Behavior) feeds, and DHS SOC integration patterns.
• Experience leading log-source onboarding across multi-tenant federal environments with strict CUI handling.

Benefits

• Equal Employer/Veterans/Disabled
• Navitas Business Consulting is an affirmative action and equal opportunity employer.
• If reasonable accommodation is needed to participate in the job application or interview process, to perform essential job functions, and/or to receive other benefits and privileges of employment, please contact Navitas Human Resources.
• Navitas is an equal opportunity employer. We provide employment and opportunities for advancement, compensation, training, and growth according to individual merit, without regard to race, color, religion, sex (including pregnancy), national origin, sexual orientation, gender identity or expression, marital status, age, genetic information, disability, veteran-status veteran or military status, or any other characteristic protected under applicable Federal, state, or local law.
• Our goal is for each staff member to have the opportunity to grow to the limits of their abilities and to achieve personal and organizational objectives.
• We will support positive programs for equal treatment of all staff and full utilization of all qualified employees at all levels within Navitas.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior