SOC Engineer -TS/SCI Security Clearance Required

Power3 Solutions•Columbia, MD

About The Position

Tulzi Technologies, LLC is seeking a mid-level SOC Engineer to work with customers on log management and SIEM needs. The role evaluates existing systems for improvement opportunities, gaps, and next-generation architecture and design, and designs and deploys new systems or upgrades existing systems to meet customer needs and protect systems from emerging threats. The SOC Engineer identifies gaps in malicious-activity detection, creates and tunes signatures and rules, develops alert and threat-detection metrics, and helps build alert-triage and incident-response playbooks. The position also recommends tools to improve network visibility; supports incident response and forensic operations, including static and dynamic malware analysis and reverse engineering; and authors and maintains scripts for detection and automation. The engineer works hands-on with tools including Logstash, Podman, Docker, Splunk, Corelight, Security Onion, Windows Operating System, and Red Hat Enterprise Linux. The role requires a TS/SCI security clearance.

Requirements

Active TS/SCI security clearance required.
At least 2 years of experience working as an information security analyst or engineer.
IAT certification: one of CASP+, CISA, CISSP, GCIH, CEH, GIAC, GCIA, CCNP-Security, CySA+, GICSP, SSCP, CHFI, CFR, Cloud+, or CND.
Vendor certification in Microsoft, Cisco, Splunk, Linux, or another related area.
Hands-on experience with tools such as Logstash, Podman, Docker, Splunk, Corelight, Security Onion, Windows Operating System, and Red Hat Enterprise Linux.

Nice To Haves

SOC experience.
Python and/or Ansible scripting experience.
Prior military experience.

Responsibilities

Work with customers to determine log management and SIEM needs.
Evaluate existing systems for improvements, gaps, and next-generation architecture and design.
Design and deploy new systems and upgrade existing systems to meet customer needs and protect systems from emerging threats.
Identify gaps in malicious-activity detection capabilities and create signatures or rules to improve detection.
Test and tune existing signatures and rules to maintain a low false-positive rate.
Assist with playbook development for alert triage and incident response.
Define and implement alert and threat-detection metrics, statistics, and analytics.
Recommend tools and technologies to improve network visibility.
Support incident response and forensic operations, including static and dynamic malware analysis and reverse engineering.
Author and maintain scripts for threat detection and automation.
Create, modify, and tune IDS signatures, SIEM correlation searches, and other detection signatures.

Benefits

Medical insurance with three CareFirst healthcare plans to choose from.
Dental insurance.
Vision insurance.
Employer covers 75% of employee insurance costs and 50% of dependent costs.
Health Savings Account contributions of $1,500 for individuals and $3,000 for families.
Company-paid life insurance and AD&D coverage.
Company-paid short-term and long-term disability insurance.
20 days of vacation.
10 holidays built into the hourly rate.
5 days of administrative time, currently used for snow, jury duty, and bereavement.
Pre-tax 401(k) program with a 6% company match.
401(k) is 100% vested from the eligibility date; eligibility begins after 90 days of employment.
Competitive compensation and benefits package.