Apply on Employer Site

Peraton · 1 day ago

CSOC Cybersecurity Engineer

Portland, OR

Full-time

Onsite

Senior Level, Lead/Staff

$104K/yr - $166K/yr

8+ years exp

Peraton is a next-generation national security company that drives missions of consequence spanning the globe. They are seeking a CSOC Cybersecurity Engineer to support a large infrastructure operator in defending its corporate and operations networks from nation-state attacks while ensuring system confidentiality, integrity, and availability.

Information TechnologyRobotics

No H1B

Security Clearance Required

U.S. Citizen Only

Responsibilities

Corporate IT side operation, patching, performance and tuning of the CSOC SIEM, EDR, SOAR and related CSOC systems such as Splunk, Axonius, CrowdStike, Swimlane, Websense, NetFlow, their system applications, log aggregators, forwarders and data storage systems' confidentiality, availability, integrity, and optimization, data input, and updating of data models and threat models

Optimize and scale the corporate Splunk deployment, including forwarder architecture, index clustering and integration with security tools

Coordination with the Operations Technology SIEM/EDR/SOAR cybersecurity engineer counterpart for the ongoing operation and health of core Splunk and related systems hardware, common information model and development of web framework, APIs, HTM for web Threat Widget integration

Collection, analysis, and response of security threats in real-time, focusing on integrating log sources, creating detection rules, tuning alerts, automating workflows, and supporting incident response to improve the company's overall security posture and regulatory compliance

Develop and tune system correlation rules, create/customize dashboards, workbooks, and reports to identify suspicious system activities and network traffic and potential security incidents for analysis by CSOC cybersecurity analysists, tune SIEM/EDRSOAR to reduce false positives (alert fatigue) improve alert fidelity, and optimize data usage

Responsible for SIEM/EDR system monitoring and verification of log processing, troubleshooting, onboard existing and new log data sources (such as servers, firewalls, cloud services), ensure proper and secure log data ingestion, parsing, and storage of and managing the log lifecycle

Create new log and threat source types, field extractions, processing, etc. integrate CSOC tools with other CSOC and OT systems and threat intelligence platforms and configure systems for automated response actions

Act as Point of Contact (POC) for SIEM/EDR ingestion of new data based on internal company customer requirements for network and system monitoring; and coordinate with other organizations such as IT and field operations to meet their security monitoring and threat detection system needs

Responsible for developing and maintaining all SIEM/EDR/SOAR System Security Plans (SSP) and other documentation required, including systems technical descriptions, architectural diagrams and operational procedures

Act as a Subject Matter Expert (SME) for the SIEM/EDR/SOAR and related CSOC systems assisting security analysts in investigating alerts and providing context for incident response

Act as POC for defining new Splunk capabilities and services in direct support of CSOC system optimization and industry best practices and requirements

Represent the CSOC systems in daily/shift operations briefings and document relevant information about notable events and hand-off responsibilities to the next shift cybersecurity engineer

Maintain knowledge of the latest cyber-attacks, recommended responses, and industry best practices released by and government and private sectors

Qualification

SIEM systemsEDR systemsSOAR systemsSplunkCybersecurity certificationsIncident responseThreat analysisPythonPowerShellCommunication skills

Required

U.S. Citizenship Required

Must have the ability to obtain / maintain a DOE L Level or DOE Secret clearance

Degree in computer science, engineering, cybersecurity, information technology, or related field

Minimum of 8 years experience with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD

Experience in roles such as systems administration, security monitoring, threat and risk assessment, incident response, CSOC operations

Hold Splunk training certifications such as Splunk Core Certified User, Splunk Cloud Certified Admin, Splunk Enterprise Certified Architect

Demonstratable proficiency in working with SIEM/EDR/SOAR systems such as Splunk, Axonius, CrowdStrike, Nessus Security Center, Swimlane, NetFlow, network security devices, firewalls, cloud security

Excellent verbal and written communications skills

Ability to communicate technical issues to both infrastructure owners and management

Must be able to work on a 4-month 24x7x365 shift rotation schedule

Preferred

Experience with Python/PowerShell, TCP/IP, VPNs, network segmentation, network protocols (DNS, DNCP, SNMP, SCADA)

Hold a cybersecurity certification such as CompTIA Security+, CISSP, CEH

Hold advanced Splunk certified training certificates such as Splunk Certified Cybersecurity Defense Engineer, Splunk SOAR Certified Automation Developer, Splunk IT Service Intelligence Certified Admin

Demonstrated problem-solving skills, knowledge of CSOC operations, or broad understanding of risk management, be able to methodically assess and test hypotheses, work independently, think innovatively and be enthusiastic to conduct research and develop tools that advance the state of the art in cybersecurity