Cybersecurity Engineer Principal

About the role

As a Cybersecurity Engineer Principal at GDIT, you will be a senior technical contributor within a Security Operations Center, responsible for designing, implementing, and automating the SIEM ecosystem while serving as the subject‑matter expert for Windows and Linux systems, EDR, and vulnerability management. This position supports federal cyber missions and requires deep, vendor‑agnostic expertise.

Key responsibilities

• Administer, harden, and automate Windows Server and Linux (Red Hat, Rocky, Ubuntu, Amazon Linux) environments; manage Active Directory, IAM, and PKI; apply secure configurations and patch baselines.
• Design, deploy, and operate distributed SIEM architectures, including clustering, data store management, and ingestion pipelines; develop parsing, timestamping, and normalization logic.
• Create high‑fidelity detection content such as correlation searches, dashboards, alerts, and reports; define retention and indexing strategies.
• Build and maintain SOAR playbooks using Python, PowerShell, and Bash; integrate ticketing, identity platforms, directory services, and threat‑intel feeds; monitor automation KPIs.
• Administer enterprise EDR platforms, manage sensor deployment and policy, tune behavioral detections, and develop custom MITRE ATT&CK‑mapped detections.
• Collaborate with multi‑customer federal teams to translate technical expertise into operational outcomes.

Required profile

• U.S. citizenship.
• 8 + years of experience in cybersecurity engineering, security operations, or related fields.
• Proven vendor‑agnostic expertise across operating systems, SIEM, SOAR, EDR, and vulnerability/compliance management.
• Ability to work in a complex, multi‑customer federal environment.

Required skills

• Windows Server administration.
• Linux (Red Hat, Rocky, Ubuntu, Amazon Linux) administration.
• Active Directory, IAM, PKI.
• PowerShell, Bash, Python scripting.
• SIEM design and operation.
• SOAR workflow development.
• EDR platform management.
• REST APIs, SDK integration.
• MITRE ATT&CK framework.
• Vulnerability and patch management.