Cybersecurity Engineer

Job Summary:

The Cybersecurity Engineer 3 is responsible for developing and implementing advanced cyber defense solutions to protect the agency's infrastructure. This role focuses on leveraging Splunk Enterprise Security to monitor, detect, analyze, and respond to cyber threats, ensuring system integrity and compliance with security standards.

Responsibilities:

• Continuously monitor network traffic, endpoint logs, and cloud security events for anomalies and potential incidents.
• Create, maintain, and tune Splunk correlation searches, alerts, and dashboards to enhance detection accuracy.
• Investigate security incidents, conduct forensic analysis, and collaborate with IT and network teams for threat remediation.
• Develop and refine detection and response playbooks based on threat intelligence and frameworks such as MITRE ATT&CK.
• Work with infrastructure teams to onboard new log sources, ensuring data integrity and normalization within the SIEM platform.
• Support audit readiness by collecting SIEM control evidence and generating compliance reports aligned with policies and standards.

Required Skills & Certifications:

• Minimum of 8 years of hands-on cybersecurity experience, specifically with SIEM or Splunk operations and threat investigations.
• Proficiency in writing SPL (Splunk Processing Language) queries.
• Strong critical thinking, problem-solving, and communication skills, with the ability to manage multiple security tickets under pressure.
• Solid understanding of networking, firewalls, endpoint detection and response (EDR), and cloud platforms such as AWS, Azure, or GCP.
• Knowledge of security frameworks (e.g., MITRE ATT&CK) and compliance standards (e.g., NIST, HIPAA, SOC 2).
• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field.

Preferred Skills & Certifications:

• Splunk Core Certified User and Splunk Core Certified Advanced Power User certifications.

Special Considerations:

• Candidate must reside physically within the United States for the duration of the assignment, in compliance with Commonwealth of Virginia security policies.
• Work involves handling sensitive security information and requires strict adherence to agency security protocols.

Scheduling:

• Position requires in-person work at the agency location in Richmond, VA.
• Assignment duration from September 28, 2026, through June 30, 2027.