Sr. Security Engineer

World Wide Technology Healthcare Solutions•San Antonio, TX

1d•Onsite

About The Position

WWT is looking for a Sr. Security Engineer to support the deployment, operation, and sustainment of cybersecurity platforms within a secure Department of Defense (DoD) environment. This role focuses on platform operations, automation, threat intelligence integration, and support of cyber defense analytics. The Sr. Security Engineer will support the deployment, configuration, API integration, and sustainment of cloud-based cyber platform components. They will maintain and troubleshoot Linux-based applications on various distributions, as well as services hosted as containers or virtual machines. The role also involves maintaining and troubleshooting network forensics technologies similar to Zeek and Suricata, developing and maintaining automation using Python scripts to support platform operations and security analytics, and supporting the integration of threat intelligence data sources and detection workflows aligned with the MITRE ATT&CK framework. Additionally, the engineer will assist with automated attack kill chain analysis and security event correlation, and support cybersecurity operations teams with platform API integration (Cloud), troubleshooting, performance monitoring, and system maintenance.

Requirements

Top Secret clearance with SCI eligibility required
Bachelor’s degree in Cybersecurity, Computer Science, Engineering, or related field.
4+ years of experience supporting cybersecurity platforms, cyber operations environments, or enterprise IT systems.
Experience with network detection and response (NDR) and intrusion detection systems (IDS) such as Zeek, Suricata, or equivalent
Experience using the Elastic Stack (Elasticsearch, Logstash, Kibana), MDE, Trellix, or Tanium to ingest, correlate, and analyze large-scale security telemetry and develop queries and dashboards to detect anomalous behavior and indicators of compromise.
Experience performing threat hunting in AWS environments using cloud telemetry such as CloudTrail and VPC Flow Logs, with familiarity leveraging HashiCorp Boundary for secure, identity-aware access to investigative systems and cloud resources.
Experience with Docker, Podman or Kubernetes for application deployments.
Experience with Type 1 hypervisors, virtual machines, EC2 instances, and Linux administration
Experience supporting security products or security operations workflows.
Minimum 4 years’ experience in DoD incident response and threat hunting
Familiarity with the Pyramid of Pain and the MITRE ATT&CK framework.
DoD 8570 IAT Level II certification (e.g., Security+ or equivalent).
AWS API integration experience
AWS Cloud Certification
Must currently have an active Top Secret/SCI Clearance or above.
Not able to offer visa sponsorship, 1099 status, or work with C2C for this role.

Nice To Haves

Experience conducting threat hunting within enterprise or mission-hosted network environments by analyzing network traffic, authentication activity, endpoint telemetry, and application logs to identify malicious activity, lateral movement, and persistence mechanisms.
Experience configuring network infrastructure to enable packet capture solutions.
Familiarity with the Cisco 3-Layer Hierarchical Model, Purdue Model, and other architectural frameworks (Strongly Preferred)
GIAC Certified Forensic Analyst (GCFA)

Responsibilities

Support deployment, configuration, API integration and sustainment of cloud-based cyber platform components.
Maintain and troubleshoot Linux based applications on various distributions.
Maintain and troubleshoot services hosted as containers or virtual machines.
Maintain and troubleshoot network forensics technologies similar to Zeek and Suricata.
Develop and maintain automation using python scripts to support platform operations and security analytics.
Support integration of threat intelligence data sources and detection workflows aligned with the MITRE ATT&CK framework.
Assist with automated attack kill chain analysis and security event correlation.
Support cybersecurity operations teams with the platform API integration (Cloud), troubleshooting, performance monitoring, and system maintenance.