Shape the future of Zero Trust cybersecurity across the Pacific. 🚀
SOSi is seeking a Cyber Security Engineer to architect, integrate, and evolve the security ecosystem supporting a mission-critical Command and Control (C2) enterprise serving more than 5,000 users across the INDOPACOM theater. You'll unite SIEM, SOAR, and Linux automation technologies into a streamlined, intelligence-driven platform that delivers actionable telemetry, automated security outcomes, and real-time risk visibility. Working alongside engineers, SOC operators, and senior government leaders, you'll help drive the next generation of cyber resilience and Zero Trust operations.
💥 At SOSi, we tackle complex technical challenges head-on—because Challenge Accepted isn’t just a motto, it’s how we operate💥
Essential Job Duties:
Zero Trust engineering
- Assess, design and maintain the roadmap for security capabilities aligned to the DoD Zero Trust Reference Architecture and Target-level activities across all seven pillars.
- Translate Zero Trust requirements into concrete configurations, segmentation rules and policies, and document how each control maps to the architecture.
- Evaluate, pilot and integrate new security technologies to close Zero Trust capability gaps.
SIEM, telemetry and analytics
- Design, deploy and tune SIEM Security, including Agent policies, integrations, index lifecycle management, data tiers and cluster sizing.
- Engineer security data pipelines that collect, filter, enrich and normalize data to a Common Schema before it reaches the SIEM, controlling volume and cost.
- Develop, test and tune detection rules, dashboards and alerts mapped to MITRE ATT&CK, reducing false positives in partnership with the SOC.
Security orchestration, automation and response (SOAR)
- Design, deploy and maintain the SOAR platform and its integrations with the SIEM, endpoint, vulnerability, identity, network and ticketing systems.
- Build and test playbooks for alert triage, enrichment, containment (e.g., isolating hosts, disabling accounts) and case management, with human approval gates where required.
- Support the Automation and Orchestration pillar of the DoD Zero Trust strategy, including policy decision and enforcement integration.
Endpoint security
- Engineer and harden enterprise endpoint protection and EDR platforms, including DoD-mandated endpoint security solutions, covering policy, host intrusion prevention and device control.
- Maintain agent health, deployment coverage and policy compliance across Windows and Linux endpoints, and forward endpoint telemetry into the SIEM.
Vulnerability management
- Operate and optimize enterprise vulnerability scanning in line with DoD requirements (e.g., ACAS), including credentialed scan design, scan zones and reporting.
- Drive remediation by correlating findings with asset owners and patch status, tracking IAVM compliance and producing risk-based remediation priorities.
Linux engineering and compliance
- Engineer, build and maintain the enterprise Linux server infrastructure, including standard hardened builds, identity integration, performance and availability, upgrades and lifecycle replacement
- Engineer Linux content lifecycle, patching and errata workflows to deliver timely, tested updates across environments.
- Automate STIG and SCAP compliance with configuration-as-code, and report compliance status to leadership.
Compliance, risk and reporting
- Implement and validate STIGs and SRGs, and produce RMF artifacts, POA&Ms and evidence for assessments and inspections (e.g., CORA).
- Interact with vendors, other agencies and coalition partners on behalf of the program.
- Contribute to After Action Reports (AARs) and submit Weekly Activity Reports (WARs) in accordance with contract requirements.
Minimum Requirements
- Active, in-scope Top Secret clearance with SCI eligibility, and a valid US passport.
- Bachelor's degree in Cyber Security, Computer Science, Information Systems, Computer Engineering or a related field and 5+ years of experience OR 9+ years of cybersecurity engineering experience in DoD or classified environment.
- 3+ years hands-on engineering (deploying, tuning and integrating, not only operating) with at least three of: SIEM (Elastic preferred), SOAR, security data pipelines, EDR, enterprise vulnerability management, and Linux configuration and patch management.
- DoD 8570 IAT-II compliant (Security+ CE, CCNA, CND, CySA+, GICSP, GSEC, or SSCP).
- Working knowledge of Zero Trust concepts, the DoD Zero Trust Reference Architecture, and tiered or privileged access models.
- Solid administration skills in Linux and Windows Server, including Active Directory, Kerberos, PKI and DNS fundamentals.
- Experience implementing STIGs and SRGs, SCAP scanning and RMF documentation in DoD environments.
- Scripting or automation in at least one of Python, PowerShell, Bash or Ansible, including REST API integrations.
- Clear written and verbal communication, including the ability to brief technical topics to senior leadership.
Preferred qualifications
- Hands-on engineering experience across all the capability areas above, including building SOAR playbooks in production.
- Elastic certifications (Elastic Certified Engineer or Analyst) and vendor certifications for the SOAR, EDR, data pipeline or vulnerability management platforms in use.
- Red Hat certifications (RHCSA or RHCE), and experience with Linux identity management integrated with Active Directory trusts.
- Experience designing detections with MITRE ATT&CK and building SOC workflows and metrics.
- Experience with privileged access workstations (PAWs), tiered or ESAE-style administration, and phishing-resistant MFA (CAC/PIV).
- Familiarity with Data Centric Security, NSA CSfC capability packages and Cross Domain Solutions (CDS).
- Experience with virtualization and hyperconverged platforms from a security-hardening perspective.
Work Environment
- Working conditions are normal for an office environment.
- Mission operations supporting a 24/5 baseline with potential evening, overnight, weekend, exercise, contingency, and surge coverage based on contract and mission requirements.
- Fast paced, deadline-oriented environment.
Working at SOSi
All interested individuals will receive consideration and will not be discriminated against for any reason.