This is a fully remote position, open to applicants in Virginia.

📋 Description

• Administer and enhance Microsoft Sentinel as the primary SIEM, focusing on analytics rules, incidents, hunting, and workbooks.

• Design and manage log ingestion and telemetry from Azure and hybrid sources into Sentinel.

• Create and uphold Torq automation playbooks for alert enrichment, routing, and incident response.

• Implement automation solutions utilizing Azure Logic Apps and associated Azure services.

• Design and support secure Azure cloud architectures that comply with enterprise security policies and frameworks such as NIST 800-53, FedRAMP, and CJIS.

• Assist with incident response and digital forensics by ensuring effective logging, querying with KQL, and reconstructing events.

• Investigate and recommend security tools and methodologies within Azure, Sentinel, and Torq.

• Contribute to the strategic planning of security initiatives.

• Generate both technical and non-technical documentation regarding configurations, assessments, and remediation efforts.

• Provide cybersecurity monitoring and engineering support to government clients within a multi-tenant MSS environment.

⛳️ Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, IT, or a related discipline, along with 2+ years of relevant cybersecurity and/or cloud engineering experience; or a Master’s degree in a related field.

• An additional 4+ years of experience may be considered as a substitute for a degree.

• Practical experience with Microsoft Sentinel, covering rules, incidents, and hunting.

• Familiarity with Azure security and logging services.

• Proficiency in KQL and JSON-based detections.

• Scripting skills in PowerShell, Python, or Bash.

• U.S. citizenship is required.

• Capability to obtain and sustain a Public Trust clearance.