Senior Cloud Security Engineer - SAIC : Job Details

Description SAIC is seeking a Senior Cloud Security Engineer to perform Cloud Security Engineering and Administration duties for our team providing Cybersecurity services for a major state & local government customer located in Texas. This position reports to our Cybersecurity Operations Director and is a member of the 24x7x365 security operations (SecOps) team. This specialist will have two primary categories of responsibilities: 1.) Being a technical leader in Azure Portal, Sentinel SIEM engineering, and associated tasks, and 2.) Supporting the incident response function. During your tenure, you will take ownership of the technical aspects of running and maintaining a SIEM, such as getting data in, authoring and tuning correlation rules, developing and maintaining PowerBI dashboards and reports, ensuring endpoints that are expected to send their logs are actually doing so, and other similar activities. You will also provide consultative advice and recommendations in support of these tasks, as well as coach, guide, and mentor less experienced cloud security specialists. Your backup/supporting responsibility will be incident response, including how to prepare, detect, respond/contain, mitigate/eradicate, report on, recover from, remediate, and learn from cybersecurity events and incidents in the enterprise. This includes authoring, modifying, and maintaining our internal SOC playbook and associated procedures, as well as have rotating on-call responsibilities.This position is 100% remote. Primary job responsibilities include:•Azure Portal Engineering and Administration:oUser administrationoLicense administrationoVM administrationoVirtual network administration •Sentinel SIEM Engineering and Administration:oAnalytics rule development, administration, troubleshooting, support oSyslog and Logstash troubleshooting, support, and administration oNXLOG and Microsoft agent support and troubleshooting oManage multiple Azure resources in support of the SIEM, such as storage blobs, key vaults, containers, etc.•Azure and Sentinel related project support: oPowerBI Dashboard creation for disparate customers oServer migrations to incorporate high-availability oOther future project work•Automation and interconnectivity oUtilize knowledge, skills, and abilities to automate a variety of tasks as it relates to threat intelligence, incident detection/response, EnCase anomaly and IOC scanning, and other activities. oDevelop and maintain Azure Logic Apps to perform data acquisition, transformation, storage, and/or transmission oConfigure and maintain API connectivity and integrations with supporting tools such as ServiceNow, and security tools oDevelop and maintain Azure data factory pipelines •Provide Support for Incident Detection and Response by performing a variety of tasks, such as:oConfigure, monitor, and manage EnCase anomaly and IOC scans oPerform Sentinel log searches in support of incident detection and response activities oProvide coaching and guidance for more junior SOC personnel Qualifications Required: •Bachelor's degree in a relevant field of study (e.g. Cybersecurity, Information Systems, Computer Science, or other relevant business or IT field), plus a minimum of five (5) years' relevant experience. •Must be a a U.S. Citizen on U.S. soil, and able to pass an annual CJIS background check. •Demonstrated experience with Microsoft Sentinel, Log Analytics, and other similar and supporting technologies; Current Microsoft Azure and/or security-related certification holders will be given strong preference. •Excellent and demonstrated oral and written communication skills, including confident and concise oral communications used in leading Security Incident Response Team (SIRT) calls. •Demonstrated experience with syslog-based logging server-side configurations and Azure portal administration and engineering. •Obtain the Cybersecurity First Responder certification within 180 days of first day of employment. Preferred: •Experience with ITIL, ITIL Foundation or higher certification. •Unix/Linux and/or Windows System Administration. •Familiarity with syslog-based logging client-side configurations. •Experience with EnCase Digital Forensics/Investigator and Endpoint Security solutions; Current EnCE certification holders will be given preference. •ISC2, SANS/GIAC, and other industry-recognized cybersecurity certification(s) will be given preference. •Experience and familiarity with Cyber Threat Intelligence (CTI) programs, including indicators of attack, compromise, etc., and associated actions taken to detect and block relevant indicators. What we will provide: •On the job training of the customer operating environment and service provider tools. •A strong teamwork-based environment that enables close collaboration and support of each other. •A flexible approach to work schedule. •Reimbursement for selected and manager- pre-approved technical training and certification. What we expect from you: •Passion, personality, and persistence - you will provide the drive to learn and grow, while we provide the technical knowledge, and enable reimbursement of costs associated with passing exam fees, course study materials, and other costs based on leadership approval prior to the cost being incurred. •You must be able to provide on-call coverage on both a planned rotation and ad-hoc when issues arise, particularly after training is complete. •Continual learning - you must be willing to continue to learn and grow through acquisition and application of additional coursework toward a new degree program and/or certifications. SAIC will provide reimbursement for a portion of, or the entirety of the costs associated with these approved on a case-by-case basis, based on leadership approval prior to the cost being incurred. Target salary range: $80,001 - $120,000. The estimate displayed represents the typical salary range for this position based on experience and other factors.SAIC accepts applications on an ongoing basis and there is no deadline.Covid Policy: SAIC does not require COVID-19 vaccinations or boosters. Customer site vaccination requirements must be followed when work is performed at a customer site.