SOC Engineer

Amentum•Columbia, MD

4d•$140,000 - $190,000•Onsite

About The Position

Come be part of a dynamic program that delivers enterprise infrastructure, systems engineering, and operational support across multiple mission-critical network environments. Our team designs, implements, and sustains modern technology solutions supporting real-world customer operations. We foster a highly collaborative and technical culture that values innovation, continuous learning, and professional growth. Team members are encouraged to expand their expertise through training opportunities, cross-functional collaboration, and hands-on experience with a wide range of technologies supporting complex operational environments.

Requirements

6+ years of experience supporting Security Operations Centers (SOC), cybersecurity engineering, SIEM engineering, or Information System Security Engineering (ISSE).
Experience deploying, administering, and maintaining Splunk Enterprise Security and/or other enterprise SIEM platforms.
Strong understanding of security event management, log management, and threat detection methodologies.
Experience developing SIEM correlation searches, analytic rules, dashboards, and detection use cases.
Experience supporting cybersecurity operations within classified or highly regulated environments.
Strong knowledge of Windows and Linux operating systems, including system administration and troubleshooting.
Experience with scripting or automation using PowerShell, Python, Bash, or similar languages.
Experience working within virtualized and containerized environments.
Understanding of common attack frameworks such as MITRE ATT&CK and cyber kill chain methodologies.
Knowledge of incident response, digital forensics, threat hunting, and malware analysis principles.
Experience producing technical documentation, architecture diagrams, implementation plans, and engineering reports.
Strong communication and customer engagement skills with the ability to explain technical concepts to both technical and non-technical stakeholders.
TS / SCI Security Clearance Required
High School Diploma or equivalent
One or more of the following IAT Certs: CISM, CISSP, or equivalent senior-level baseline certification
One or more relevant vendor certification (e.g., Microsoft, VMware, Cisco, NetApp, Pure Storage, HP, Dell, Linux+, Red Hat, HBSS, ACAS). Candidates without an active certification must obtain at least one within 6 months of hire.

Nice To Haves

Bachelor's Degree in Information Technology, Computer Science, Engineering, or related field
Experience with Splunk Enterprise Security, Security Onion, Corelight, Zeek, Suricata, Elastic, or similar cybersecurity platforms.
Experience with Logstash, Docker, Podman, and containerized application deployments.
Experience integrating threat intelligence feeds into SIEM and detection platforms.
Familiarity with SOAR technologies and security automation frameworks.
Experience performing malware analysis, reverse engineering, or digital forensics.
Experience supporting DoD, Intelligence Community, or classified enterprise networks.
Experience with Red Hat Enterprise Linux administration.
Familiarity with cloud security platforms including AWS, Azure, or Google Cloud.
Experience with NIST RMF, NIST 800-53, STIGs, CIS Benchmarks, or equivalent compliance frameworks.
Experience with VMware, Hyper-V, Nutanix, or other enterprise virtualization platforms.
Experience with enterprise backup, disaster recovery, and business continuity solutions.
Prior Security Operations Center experience
Experience with Zero Trust architectures
Prior Military experience

Responsibilities

Design, implement, configure, and maintain SIEM, log management, and security monitoring solutions supporting enterprise cybersecurity operations.
Evaluate existing SOC architectures and recommend improvements to increase operational effectiveness, scalability, and threat visibility.
Engineer and optimize log collection pipelines to ensure comprehensive security event coverage across network, system, application, and cloud environments.
Develop, test, tune, and maintain detection content, including correlation searches, threat detections, alerts, signatures, and analytics.
Identify gaps in detection coverage and implement solutions aligned with current threat intelligence and adversary techniques.
Create and maintain SOC playbooks, standard operating procedures, and incident response workflows.
Support security incident investigations through log analysis, endpoint analysis, malware analysis, and forensic data collection.
Design and implement security automation and orchestration capabilities to reduce analyst workload and improve response times.
Develop metrics, dashboards, and reporting capabilities to measure SOC performance, alert fidelity, detection effectiveness, and operational health.
Participate in threat hunting activities to identify stealthy or previously undetected malicious activity.
Support malware analysis efforts, including static and dynamic analysis techniques and reverse engineering activities when required.
Author scripts and automation tools using languages such as Python, PowerShell, or Bash to improve SOC efficiency and detection capabilities.
Document technical architectures, operational procedures, engineering designs, and implementation plans.
Provide technical recommendations regarding emerging security technologies, tools, and best practices.
Collaborate with customer stakeholders to understand mission requirements and translate those requirements into technical solutions.