Cyber Security Engineer

Joint Base Pearl Harbor Hickam, HI, us · On site · Posted 20h Leaves the board in 7 days
ATS Keyword Match See which key terms from this posting your resume already has. Free. Posting says: Fast paced

Shape the future of Zero Trust cybersecurity across the Pacific. 🚀 

SOSi is seeking a Cyber Security Engineer to architect, integrate, and evolve the security ecosystem supporting a mission-critical Command and Control (C2) enterprise serving more than 5,000 users across the INDOPACOM theater. You'll unite SIEM, SOAR, and Linux automation technologies into a streamlined, intelligence-driven platform that delivers actionable telemetry, automated security outcomes, and real-time risk visibility. Working alongside engineers, SOC operators, and senior government leaders, you'll help drive the next generation of cyber resilience and Zero Trust operations.

💥 At SOSi, we tackle complex technical challenges head-on—because Challenge Accepted isn’t just a motto, it’s how we operate💥

Essential Job Duties:

Zero Trust engineering

  • Assess, design and maintain the roadmap for security capabilities aligned to the DoD Zero Trust Reference Architecture and Target-level activities across all seven pillars.
  • Translate Zero Trust requirements into concrete configurations, segmentation rules and policies, and document how each control maps to the architecture.
  • Evaluate, pilot and integrate new security technologies to close Zero Trust capability gaps.

SIEM, telemetry and analytics

  • Design, deploy and tune SIEM Security, including Agent policies, integrations, index lifecycle management, data tiers and cluster sizing.
  • Engineer security data pipelines that collect, filter, enrich and normalize data to a Common Schema before it reaches the SIEM, controlling volume and cost.
  • Develop, test and tune detection rules, dashboards and alerts mapped to MITRE ATT&CK, reducing false positives in partnership with the SOC.

Security orchestration, automation and response (SOAR)

  • Design, deploy and maintain the SOAR platform and its integrations with the SIEM, endpoint, vulnerability, identity, network and ticketing systems.
  • Build and test playbooks for alert triage, enrichment, containment (e.g., isolating hosts, disabling accounts) and case management, with human approval gates where required.
  • Support the Automation and Orchestration pillar of the DoD Zero Trust strategy, including policy decision and enforcement integration.

Endpoint security

  • Engineer and harden enterprise endpoint protection and EDR platforms, including DoD-mandated endpoint security solutions, covering policy, host intrusion prevention and device control.
  • Maintain agent health, deployment coverage and policy compliance across Windows and Linux endpoints, and forward endpoint telemetry into the SIEM.

Vulnerability management

  • Operate and optimize enterprise vulnerability scanning in line with DoD requirements (e.g., ACAS), including credentialed scan design, scan zones and reporting.
  • Drive remediation by correlating findings with asset owners and patch status, tracking IAVM compliance and producing risk-based remediation priorities.

Linux engineering and compliance

  • Engineer, build and maintain the enterprise Linux server infrastructure, including standard hardened builds, identity integration, performance and availability, upgrades and lifecycle replacement
  • Engineer Linux content lifecycle, patching and errata workflows to deliver timely, tested updates across environments.
  • Automate STIG and SCAP compliance with configuration-as-code, and report compliance status to leadership.

Compliance, risk and reporting

  • Implement and validate STIGs and SRGs, and produce RMF artifacts, POA&Ms and evidence for assessments and inspections (e.g., CORA).
  • Interact with vendors, other agencies and coalition partners on behalf of the program. 
  • Contribute to After Action Reports (AARs) and submit Weekly Activity Reports (WARs) in accordance with contract requirements.

Minimum Requirements

  • Active, in-scope Top Secret clearance with SCI eligibility, and a valid US passport.
  • Bachelor's degree in Cyber Security, Computer Science, Information Systems, Computer Engineering or a related field and 5+ years of experience OR 9+ years of cybersecurity engineering experience in DoD or classified environment.
  • 3+ years hands-on engineering (deploying, tuning and integrating, not only operating) with at least three of: SIEM (Elastic preferred), SOAR, security data pipelines, EDR, enterprise vulnerability management, and Linux configuration and patch management.
  • DoD 8570 IAT-II compliant (Security+ CE, CCNA, CND, CySA+, GICSP, GSEC, or SSCP).
  • Working knowledge of Zero Trust concepts, the DoD Zero Trust Reference Architecture, and tiered or privileged access models.
  • Solid administration skills in Linux and Windows Server, including Active Directory, Kerberos, PKI and DNS fundamentals.
  • Experience implementing STIGs and SRGs, SCAP scanning and RMF documentation in DoD environments.
  • Scripting or automation in at least one of Python, PowerShell, Bash or Ansible, including REST API integrations.
  • Clear written and verbal communication, including the ability to brief technical topics to senior leadership.

Preferred qualifications

  • Hands-on engineering experience across all the capability areas above, including building SOAR playbooks in production.
  • Elastic certifications (Elastic Certified Engineer or Analyst) and vendor certifications for the SOAR, EDR, data pipeline or vulnerability management platforms in use.
  • Red Hat certifications (RHCSA or RHCE), and experience with Linux identity management integrated with Active Directory trusts.
  • Experience designing detections with MITRE ATT&CK and building SOC workflows and metrics.
  • Experience with privileged access workstations (PAWs), tiered or ESAE-style administration, and phishing-resistant MFA (CAC/PIV).
  • Familiarity with Data Centric Security, NSA CSfC capability packages and Cross Domain Solutions (CDS).
  • Experience with virtualization and hyperconverged platforms from a security-hardening perspective.

Work Environment

  • Working conditions are normal for an office environment.
  • Mission operations supporting a 24/5 baseline with potential evening, overnight, weekend, exercise, contingency, and surge coverage based on contract and mission requirements.
  • Fast paced, deadline-oriented environment.

Working at SOSi

All interested individuals will receive consideration and will not be discriminated against for any reason.

Founded in 1989 and headquartered in Reston, Virginia, SOSi is a private defense and government solutions business specializing in advanced technology systems and mission support. Its capabilities include data science, software development, network engineering, intelligence, surveillance, and reconnaissance (ISR), and logistics.