Apply on Employer Site

Zscaler · 1 day ago

Federal Security Platforms Lead (Principal Information Security Engineer)

McLean, VA

Full-time

Onsite

Lead/Staff

$161K/yr - $230K/yr

8+ years exp

Zscaler accelerates digital transformation and is seeking a Federal Security Platforms Lead (Principal Information Security Engineer) to join their Enterprise Security team. The role involves building and owning the security detection and response platform for a new DoD/DoW IL6 cloud environment, with responsibilities including the architecture and optimization of Splunk Enterprise Security.

Cloud SecurityCyber SecurityEnterprise SoftwareSecurity

No H1B

Security Clearance Required

U.S. Citizen Only

Responsibilities

Architect, implement, and optimize Splunk Enterprise Security from the ground up, including ingestion pipelines, CIM normalization, indexer/search head clustering, and HA/DR across DoD IL6 environment

Design, build, and tune high-fidelity detections mapped to MITRE ATT&CK and DoD threat profiles while managing the full content lifecycle, QA, version control, and false-positive reduction

Define telemetry requirements and lead onboarding for cloud, endpoint, identity, and network sources to ensure data quality, normalization, and enrichment to close coverage gaps

Develop SOAR automation and triage workflows, deliver analyst-facing dashboards and hunt workspaces, and partner with Incident Response for operationalization and continuous improvement

Operate the SIEM/SOAR platform for a 24/7 environment and ensure configurations, retention, encryption, and RBAC align with FedRAMP, DoD CC SRG, and DISA STIGs

Qualification

Splunk Enterprise SecuritySecurity engineeringFedRAMP compliancePythonSOAR automationMITRE ATT&CKUrgencyPragmatic buildingCollaborationProblem-solving

Required

US Citizenship and an active U.S. Secret Security Clearance (Top Secret preferred), with a willingness to participate in an on-call rotation (nights and weekends)

8+ years of security engineering or operations in FedRAMP/DoD environments, supporting 24/7 mission needs

Experienced in architecting, administering, and optimizing clustered Splunk Enterprise Security deployments, including ingestion pipelines and CIM normalization across GovCloud/Secret regions

Skilled at configuring data retention, encryption, and indexer/search head clustering for resilient, compliant log management aligned to FedRAMP and DoD CC SRG

Proficient in SPL to build and tune correlation searches, dashboards, and risk-based alerting; partnered with IR to improve signal quality and reduce false positives