Senior Cybersecurity Engineer (Trelix)

Type of Requisition:

Regular

Clearance Level Must Currently Possess:

Top Secret/SCI

Clearance Level Must Be Able to Obtain:

Top Secret/SCI

Public Trust/Other Required:

None

Job Family:

Cyber and IT Risk Management

Job Qualifications:

Skills:

Cybersecurity, Endpoint Security, Linux, Splunk Enterprise Security

Certifications:

None

Experience:

8 + years of related experience

US Citizenship Required:

Yes

Job Description:

Description: We are seeking a highly skilled and multi-faceted Cyber Engineer for a critical contract role supporting Google's SIPRNet enclave. The ideal candidate is a proactive and seasoned professional with extensive, hands-on experience navigating Trelix, Red Hat Linux, the NIST 800-53 Risk Management Framework (RMF) control requirements, and Security Operations for a classified network in a unique commercial cloud setting. This role requires a blend of technical engineering prowess to provide Security Operations support as well as a deep understanding of continuous monitoring control requirements to prepare for security assessments and auditing. You will be a key contributor to our SIPR Enclave team, supporting the SIPR Enclave Lead in RMF activities and the Senior Cyber Engineer in security operations support. 

  

  

How the Cybersecurity Engineer will make an impact:

From a RMF perspective, as directed by the SIPR Enclave Lead -  

• Supports maintaining the Continuous Monitoring program, specifically around vulnerability management, endpoint security, auditing, and security alert triage/monitoring. 

• Supports control implementation statement updates, documentation development for plans or procedures, artifact identification for assessments, and body of evidence generation. 

• Supports POAM mitigation and/or remediation activities. 

From a Security Tools administrative perspective, as directed by the Senior Cyber Engineer, the Engineer -  

• Update and maintain security tool versions (Trelix, etc)

• Configure, patch, and update the Linux operating systems 

• Monitors the security applications such as Trelix

• Scanning implementation (Tenable.sc, SCC Tool)

• SIEM implementation (Splunk)

• Endpoint security implementation (Trellix) 

• Works with the vendors of the security applications as applicable to maintain security updates, licenses, resolve support issues (e.g., for Tenable plugins), etc.

For Endpoint Management:

• Ensures all hosts can be seen in the endpoint security application with ongoing monitoring and applicable policies applied. 

• Triages all alerts from the tool to ensure activity in the environment is authorized. 

For insider threat monitoring: 

• Ensures deployment of tool and related modules are performing as intended. 

• Monitors aggregate user data as directed. 

• Designs, develops, tests, and evaluates information system security throughout the systems development life cycle. 

For the SIEM: 

• Ensure security systems are up to date and implemented. 

• Validate the telemetry from the hosts and security applications are forwarded to the SIEM. 

• Configures alerts for privileged activity that would be conducted in the enclave as well as alerts from security advisories.

• Triages all alerts from the SIEM to ensure activity in the environment is authorized. 

• Investigates, resolves, and reports security incidents in alignme