Apply on Employer Site

Zachary Piper Solutions · 1 day ago

IDS/IPS Cyber Engineer

Reston, VA

Full-time

Onsite

Mid, Senior Level

$130K/yr - $155K/yr

3+ years exp

Zachary Piper Solutions seeks a Network Intrusion Detection Engineer to join our cybersecurity team. The role involves deploying, tuning, and maintaining IDS/IPS systems within a complex enterprise IT environment, ensuring optimal detection capabilities and minimal false positives.

GovernmentInformation ServicesInformation TechnologySoftware

Growth Opportunities

No H1B

Security Clearance Required

U.S. Citizen Only

Responsibilities

Designing, deploying, and maintaining IDS/IPS systems across a large enterprise with multiple networks

Developing, reviewing, and optimizing YAML configuration files to ensure optimal detection capabilities and minimal false positives

Understanding and managing the interaction between YAML configuration and its runtime engine, including rule loading, protocol decoding, and logging

Tuning IDS/IPS for optimal performance with NICs, including configuring Direct Memory Access (DMA), RSS queues, interrupt coalescing, and leveraging any NIC-specific acceleration features

Collaborating with security teams to integrate IDS/IPS with SIEM and other security monitoring platforms

Troubleshooting installation and operational issues specific to IDS/IPS on Red Hat Enterprise Linux, addressing compatibility, kernel module requirements, SE-Linux policies, and performance tuning

Identifying and mitigating common pitfalls encountered when deploying IDS/IPS in large-scale enterprise environments, including package dependencies, system resource constraints, and NIC driver/configuration issues

Provide detailed documentation and runbooks for Suricata configuration, tuning NICs, and deployment processes

Staying current with Platform IDS/IPS Software releases, NIC driver updates, and community best practices for network interface tuning and IDS/IPS performance enhancement

Qualification

SuricataSnortRed Hat Enterprise LinuxYAML configurationDoD 8570.01-M CertificationActive TS/SCI ClearanceTroubleshootingCollaboration

Required

Active TS/SCI clearance and willingness to sit for CI Poly needed for consideration

Associate's degree and 5+ years of experience supporting IT projects and activities or Bachelor's degree and 3+ years of experience supporting IT projects and activities or Master's degree and 1+ years of experience supporting IT projects and activities. Years of experience may be accepted in lieu of degree

Proven experience working with Snort, Suricata, Corelight or other network IDS/IPS systems, including hands-on management of its YAML configuration files

Strong knowledge of configuration structure, syntax, and how it controls detection rules, logging, and output modules

Extensive experience administering Red Hat Enterprise Linux (RHEL) systems

Active DoD 8570.01-M Certification (Security+ CE, CCNA-Security, GSEC, SSCP, CySA+, GICSP, or CND)

Ability to obtain a DoD 8570.01-M Cybersecurity Service Provider (CSSP) - Infrastructure Support (IS) certification, including CEH, CySA+, GICSP, SSCP, CHFI, CFR, Cloud+, or CND prior to start date

Active TS/SCI Clearance with CI Poly