SOC Engineer (TS/SCI) - SIEM, Threat Detection & Automation

About the role

Amentum is seeking a highly motivated SOC Engineer to support the design, deployment and continual improvement of enterprise Security Operations Center capabilities. This is a hands-on, keyboard position working in classified environments, supporting SIEM engineering, log management, threat detection, security automation and incident response. It is an IAT3 billet with a schedule of 8 hours per day, 5 days per week, all onsite, with occasional after-hours work.

Key responsibilities

• Design, implement, configure and maintain SIEM, log management and security monitoring solutions
• Evaluate SOC architectures and recommend improvements to increase threat visibility and scalability
• Optimize log collection pipelines across network, system, application and cloud environments
• Develop, tune and maintain detection content such as correlation searches, alerts, signatures and analytics
• Create and maintain SOC playbooks, SOPs and incident response workflows
• Support incident investigations through log, endpoint, malware and forensic analysis
• Build security automation and orchestration to reduce analyst workload
• Develop metrics, dashboards and reporting on SOC performance and detection effectiveness
• Participate in threat hunting and malware analysis, and author scripts in Python, PowerShell or Bash
• Document architectures, procedures and plans, and advise on emerging security technologies

Required profile

• 6+ years supporting SOC, cybersecurity engineering, SIEM engineering or ISSE
• Experience with Splunk Enterprise Security and/or other enterprise SIEM platforms
• Experience in classified or highly regulated environments
• Security clearance: TS / SCI
• One or more of CISM, CISSP or equivalent senior certification, plus a vendor certification (e.g. Microsoft, VMware, Cisco, Red Hat); candidates without an active cert must obtain one within 6 months
• Preferred: IAT3, Splunk, Logstash, Docker, Podman, threat intelligence feeds, SOAR, malware analysis, DoD/IC experience, prior SOC experience, Zero Trust, prior military experience

Required skills

• Strong knowledge of Windows and Linux, including administration and troubleshooting
• Scripting with PowerShell, Python or Bash
• Virtualized and containerized environments
• MITRE ATT&CK, cyber kill chain, incident response, forensics, threat hunting and malware analysis
• Technical documentation, architecture diagrams and engineering reports

What we offer

• Compensation range of $145,000 - $190,000
• Health, dental and vision insurance, paid time off and holidays
• Retirement benefits including 401(k) matching, educational reimbursement, parental leave
• Employee stock purchase plan, disability and life insurance, pet insurance