Chief Cyber Security Engineer

Title: Chief Cyber Security Engineer

Location: (New Carolton, MD)

Terms: Full-time

Clearance: US Citizen and clearable (Top-Secret preferred)

Travel: 0% ( onsite presence at client facilities as directed)

Position Description

We are seeking an experienced Chief Cyber Security Engineer to serve as the senior technical authority for Security Operations Center (SOC) engineering supporting a large federal agency. This Key Personnel role independently leads the design, integration, and architecture of SOC tools, sensors, platforms, and enclaves across an enterprise of hundreds of thousands of network connections and endpoints spanning on-premises data centers and FedRAMP cloud environments. The Chief Cyber Security Engineer leads the SOC engineering team, directs detection engineering and custom capability development, and guides the client through its transition from on-premises to hybrid on-premises and cloud operations.

The successful candidate will:

• Serve as the Subject Matter Expert (SME) and technical lead for SOC engineering, deployment, and capability sustainment.
• Deliver a secure, resilient, and well-integrated SOC architecture across on-premises, AWS, and Microsoft Azure/M365 environments.
• Maintain 99.9% availability of security infrastructure and keep security mechanisms on supported, fully patched versions.
• Improve detection quality and reduce false positives through disciplined sensor, rule, and analytics tuning.
• Lead and mentor a team of security engineers, administrators, and detection specialists through project completion.
• Provide expert cybersecurity perspective to client IT organizations planning, architecting, and implementing new capabilities, including FedRAMP cloud migrations.
• Preserve knowledge continuity through current engineering documentation and effective knowledge transfer to client personnel.

Responsibilities:

• Lead cybersecurity architecture, strategy, research, evaluation, prototyping, integration, deployment, and sustainment of SOC technologies.
• Design and architect major systems and systems of systems, including SOC tools, sensors, SIEM/SOAR platforms, enclaves, and supporting data pipelines across hybrid on-premises and cloud environments.
• Direct the deployment, configuration, operation, maintenance, and troubleshooting of SOC tools, sensors, platforms, and enclaves across multiple client sites.
• Ensure engineered solutions comply with agency policies, standards, hardening guidelines, NIST guidance, and approved technical direction.
• Drive integration and interoperability of SOC tools, sensors, data sources, workflows, and applications, including log and telemetry ingestion from AWS, Azure/M365, and other cloud platforms.
• Oversee detection engineering, including development, testing, validation, and documentation of custom analytics, detections, dashboards, scripts, interfaces, and automation and orchestration playbooks.
• Direct sensor, rule, alert, and analytics tuning and report regularly on signature maintenance and detection performance.
• Lead prototyping and evaluation of new SOC technologies and conduct market research on new security hardware and software.
• Author and approve engineering design documentation, change and release documentation, test plans, and end-to-end configuration flow diagrams.
• Represent technical change requests before the client’s Change Control Board and ensure emergency configuration changes are documented promptly.
• Ensure security mechanisms are patched promptly after vendor release, planned downtime is coordinated in advance, and unplanned outages are reported immediately.
• Assist the client in maintaining SOC tool, asset, software license, support agreement, and inventory information.
• Provide engineering support to incident response, containment, eradication, and recovery actions, and to threat hunting remediation activities.
• Supervise, assign, and review the work of SOC engineers and administrators; validate staff technical qualifications and readiness.
• Lead knowledge transfer to client personnel and maintain SOPs, technical guides, architecture diagrams, configuration notes, and deployment records.
• Support surge efforts and new requirements arising from evolving architectures, emerging threats, and new federal cybersecurity mandates.

Required Skills and Experience

• Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related field; three (3) years of additional relevant experience may be substituted in lieu of a degree.
• 15+ years of overall professional experience in cybersecurity, systems engineering, and systems integration.
• CISSP certification with eight (8) years of cybersecurity engineering experience; OR an Advanced Degree (M.S. or higher in Information Assurance, Information Systems Security, Cybersecurity, or a closely related field such as an MBA or M.S. in Computer Science with a cybersecurity emphasis) with eight (8) years of experience; OR ten (10) years of experience as a cybersecurity engineer in a governmental organization (as a Government or contractor employee).
• Five (5) years of experience with governmental (FedRAMP) hybrid on-premises and cloud technology stack environments.
• Expert knowledge of the design, implementation, and architecture of major systems, systems of systems, and the integration of system elements and related support systems.
• Demonstrated experience engineering and sustaining enterprise SOC technologies (e.g., SIEM, SOAR, EDR, IDS/IPS, network sensors, packet capture, log aggregation) in large federal environments.
• Experience developing and tuning detections, analytics, and automation playbooks to improve detection fidelity and reduce false positives.
• Working knowledge of the NIST Cybersecurity Framework, NIST SP 800-53, FISMA, FedRAMP, and federal change and configuration management processes.
• Experience supervising a broad team of engineers and leading technical work through project completion.
• Experience producing architecture diagrams, engineering design documentation, test plans, and operational runbooks.

Desired

• Experience leading an on-premise to hybrid on-premise/cloud network or SOC transition.
• Hands-on experience securing and monitoring AWS and Microsoft Azure/M365 environments; familiarity with Oracle Cloud.
• Experience with mixed Windows, RHEL/*nix, virtualized (VMware, Citrix, Hyper-V), and mainframe environments.
• Prior experience supporting a large federal civilian agency SOC.
• Additional certifications such as CISSP-ISSAP, CISSP-ISSEP, GIAC (GCIA, GCDA, GCED), AWS Security Specialty, or Azure Security Engineer.
• Active Top Secret clearance.

Work Authorization/Clearance: U.S. Citizenship is required with Top-Secret Clearance preferred.