Cybersecurity Tools

Cybersecurity Tools Jobs

1,471 jobs found

Today

Cybersecurity Operations Specialist

MANTECH McLean, VA

McLean, VA

Today

Full time Ai Security Cybersecurity Operations Cybersecurity Operations Lead

Apply Now

Job Description

MANTECH is hiring a Cybersecurity Operations Specialist in McLean, VA to support cybersecurity incident response as a primary technical expert and operations lead. This onsite role blends deep incident investigation with security workflow engineering, along with management oversight, operational reporting, and contract compliance across enterprise and cloud environments.

Role Focus

You will serve as the tier-3 escalation point for complex, high-impact, multi-vector threats, driving investigations end-to-end and shaping how analysts and tooling respond to emerging risk. The position also emphasizes automation and operational readiness, including exercises, threat hunting, and maintaining technical toolsets and failover procedures for alternate-site operations.

Responsibilities

Lead end-to-end incident investigations across cloud and enterprise architectures as the tier-3 escalation lead for complex, high-impact, multi-vector security threats.
Architect automated playbooks, integrate threat intelligence, and leverage AI capabilities within SIEM/EDR tools to improve detection and streamline analyst workflows.
Design and execute exercises, perform threat hunting, and maintain technical toolsets and failover procedures for alternate-site operations.
Manage shift personnel, conduct performance evaluations and 1-on-1 coaching, oversee onboarding, and maintain rosters to ensure continuous operational coverage.
Provision and audit role-based access control (RBAC), enforce documentation standards, and manage emergency continuity and relocation protocols.
Own operational KPIs, deliver executive reporting on threat trends and program health, and align workflows with contract and government leadership.

Requirements

High School Diploma
10+ years of cybersecurity experience
5+ years in cyber defense operations, incident response, or CSOC environments
3+ years managing or leading technical staff, including oversight of schedules and administrative deliverables
Experience leading complex incident response investigations across multi-cloud and enterprise architectures
5+ years supporting large, classified cybersecurity contracts within the IC
GIAC GCIH, GCFA, GNFA, CCSP, or CISSP certification(s)
Project Management Professional (PMP) or ITIL certification(s)
Active/current TS/SCI with Polygraph is required
Must be able to remain in a stationary position 50% of the time

Technologies

SIEM/EDR
RBAC
AI

View full job page →

Today

Cybersecurity Analyst

Unisys Santa Clara, CA

Santa Clara, CA

Today

$72k - $96k/yr Full time Cyber Security Cybersecurity Analysis Cybersecurity Operations

Apply Now

Job Description

The Cybersecurity Analyst role supports an assigned organization by performing foundational security analysis and assisting with monitoring, investigation, and response activities. This position contributes to daily security operations, documentation, and risk assessment work.

Role Overview

The Cybersecurity Analyst monitors, analyzes, investigates, and responds to daily security reports and security events or incidents. The role also supports security risk assessment and documentation efforts, helping ensure that security findings are identified, tracked, and addressed appropriately.

Key Responsibilities

Perform a broad range of basic cybersecurity analysis tasks within an assigned organization or functional area.
Monitor, analyze, investigate, and respond to information provided in daily security reports.
Assist with monitoring security events and incidents generated from the security information management system.
Execute operational security tasks and respond to security-related inquiries from internal and external customers.
Monitor and assess vendor and third-party cybersecurity reports and documentation.
Conduct cybersecurity risk assessments and support control selection activities.
Identify anomalous events and security infractions that exploit system vulnerabilities.
Create and maintain network security documentation.

Required Qualifications

BA/BS degree and 2 to 4 years of relevant experience, or an equivalent combination of education and experience.

Tools and Technologies

Security information management system

Location

Santa Clara, CA (onsite)

Compensation

USD 72,000 - 96,000 per year

Benefits

Unlimited paid time off
401(k) plan
Comprehensive healthcare
HSA matching
Ongoing learning opportunities
Work-life balance
Investing in future success

Export Control Notice

This role may require access to export-controlled commodities and technology. To conform to U.S. export control regulations, the applicant should be eligible for any required authorizations from the U.S. Government.

View full job page →

Today

Cybersecurity Cloud SME

Amyx, Inc. Columbus, OH

Columbus, OH

Today

$135k - $145k/yr Full time Aws Cloud Security Cloud Platforms Cloud Security

Apply Now

Job Description

Amyx, Inc. is seeking a Cybersecurity Cloud SME to help ensure cloud-hosted IT systems are designed and architected to be secure and aligned with DoD requirements. Based in Columbus, OH (onsite) (or Richmond, VA as referenced in the role summary), you will support cloud security posture, deployment compliance, and vulnerability assessment guidance for cloud hosting environments.

This position focuses on improving cloud security policies and providing technical input across deployment lifecycles, with additional responsibility for advising assessment staff on cybersecurity vulnerability assessments related to cloud-hosted systems.

Responsibilities

Review cloud security policy and provide recommendations to strengthen cloud security posture, including the ability to meet protection, detection, monitoring, and response requirements for systems and data.
Use knowledge of current advances in cloud security engineering and cloud security threats to support deployment of programs and applications.
Provide input to programs throughout deployment to help ensure systems meet DOD compliance requirements.
Guide assessment staff during Cybersecurity Vulnerability Assessments for cloud hosting environments.

Requirements

Two (2) years of experience achieving ATOs in a cloud environment (OCI, AWS, Azure, GCP).
Five (5) years of achieving ATOs for compartment DoD IT systems.
DOD Secret Clearance.
Must possess IT-II Non-Critical Sensitive security clearance or Tier 3.
Primary DCWF Work Role 521: Cyber Defense Infrastructure Support Proficiency Level: Intermediate.
Secondary DCWF Work Role 441: Network Operations Specialist Proficiency Level: Intermediate.
Computing Environment: Cloud Security Certification (OCI, AWS, Azure, GCP).

Technology Stack

Microsoft Excel and Access
Microsoft Office suite including Word, PowerPoint, and SharePoint
SNORT
Cribl
Splunk
OCI, AWS, Azure, GCP

Benefits

Medical, Dental, and Vision Plans (PPO & HSA options available)
Flexible Spending Accounts (Health Care & Dependent Care FSA)
Health Savings Account (HSA)
401(k) with matching contributions
Roth
Qualified Transportation Expense with matching contributions
Short Term Disability
Long Term Disability
Life and Accidental Death & Dismemberment
Basic & Voluntary Life Insurance
Wellness Program
PTO
11 Holidays
Professional Development Reimbursement

Physical Demands

Ability to sit at a workstation for extended periods; use hands to handle or feel objects, tools, or controls; reach with hands and arms; talk and hear.
Ability to work on a desktop or laptop computer for extended periods, including reading, reviewing or analyzing information, and providing recommendations, summaries, and/or reports in written format.
Ability to effectively communicate verbally and in writing.
May be required to occasionally lift and/or move moderate amounts of weight, typically less than 20 pounds.
Regular and predictable attendance is essential.

Compensation: USD 135,000 - 145,000 per year. Experience: minimum 2 years. Location: Columbus, OH (onsite).

View full job page →

Today

Cybersecurity and Ethical Hacking – Adjunct Faculty

Grand Canyon University Phoenix, AZ

Phoenix, AZ

Today

Part time Cybersecurity Cybersecurity Instruction Cybersecurity Tools

Apply Now

Job Description

Grand Canyon University is seeking a part-time adjunct faculty member to teach Cybersecurity and Ethical Hacking in a face-to-face format at the Phoenix campus. The appointment supports course delivery for the Spring 2027 semester, running 01/04/2027 - 04/23/2027.

On-site Location and Schedule

Phoenix, AZ (onsite). Courses are delivered in person on the GCU Traditional Campus for the Spring 2027 Semester.

Course Focus: Cybersecurity and Ethical Hacking

This course examines mathematical models for computer security and compares the properties of models used to evaluate hardware, software, and database security. Students also explore how system designs, network protocols, and software engineering practices can introduce vulnerabilities.

Learners develop skills to design, evaluate, ethically hack, and implement appropriate security measures intended to help protect sensitive information.

Responsibilities

Facilitate classroom lectures and discussions related to course objectives
Support student engagement with course topics and learning goals
Assess student performance and mentor success within the classroom setting
Serve as a positive example by supporting the University’s Doctrinal Statement, Ethical Position Statement, and Mission of Grand Canyon University

Required Qualifications

Minimum requirement: A bachelor’s degree in Information Technology, Computer Information Systems, Cybersecurity, or a related field, plus 10+ years of experience designing and/or implementing security infrastructures, conducting security assessments, penetration testing, or risk analysis.

Preferred Qualifications

Master’s degree in Information Technology, Computer Information Systems, Cybersecurity, or a related field
2-5 years of experience designing and/or implementing security infrastructures, conducting security assessments, penetration testing, or risk analysis

Additional preferred technical familiarity includes Kali Linux, Microsoft Servers, network administration, and Linux administration.

Certifications

Preference is given to candidates holding CISSP, CEH, CISM, GIAC, or CompTIA Security+.

Relevant Technologies

Kali Linux
Microsoft Servers
CISSP
CEH
CISM
GIAC
CompTIA Security+

Benefits

Tuition benefits specifically for the adjunct employee
401(k)
Employee Perks and Discounts
Gym and Fitness Center
Canyon Health & Wellness Center

Application Document Requirements

Before submitting your application, attach the following for review:

Your unofficial transcript showing the earned degree and 18 graduate credit hours in the areas listed above
Your unofficial transcripts for any applicable conferred graduate degrees

View full job page →

Today

Senior Security Engineer- Security Operations

GE Appliances Louisville, KY

Louisville, KY

Today

Full time Senior Cloud Platforms Cybersecurity Operations

Apply Now

Job Description

Senior Security Engineer (Security Operations) to serve as the senior technical lead for GE Appliances’ detection and response capability, focused on SOC engineering, automation, telemetry, and Tier 3 escalation.

Responsibilities

Act as senior technical lead and subject-matter expert for security operations, owning detection and response platform architecture, configuration, and operational health, plus the technical standards the MSSP operates against.
Design, build, test, and maintain detection content including correlation rules, behavioral analytics, and IOC/BIОC rules mapped to MITRE ATT&CK, using detection-as-code practices (version control, testing, peer review, and documentation).
Own telemetry coverage: identify visibility gaps, onboard and normalize log sources across endpoints, identity, Microsoft 365, cloud, network, email, DLP, and OT; monitor ingestion health and manage data volume and retention cost.
Engineer security automation and orchestration (SOAR) playbooks and integrations to enrich alerts, automate containment, and connect security tooling with IT service management and collaboration platforms to reduce manual work and MSSP handling time.
Provide technical oversight of MSSP output in partnership with the Information Security leader who owns the MSSP commercial relationship: review triage and investigation quality, escalation accuracy, and run-book adherence.
Drive false-positive reduction and tuning, and update MSSP run books and playbooks as detections and the environment change.
Serve as the Tier 3 escalation point for complex or high-severity incidents escalated by the MSSP, performing hands-on investigation, endpoint and log analysis, scoping, and containment, and coordinating with an external incident response retainer when engaged.
Lead hypothesis-driven threat hunting using threat intelligence and manufacturing-relevant threats, converting hunt findings into durable detections and hardening recommendations.
Operationalize threat intelligence by translating advisories, vulnerability disclosures, and adversary reporting into detections, hunts, and blocking actions, tracking threat actors relevant to GE Appliances.
Validate detection and response effectiveness through purple-team exercises, adversary emulation, and breach-and-attack simulation, measuring coverage against MITRE ATT&CK and confirming expected MSSP detection and response.
Maintain EDR/XDR platform health across endpoint and server estate: agent coverage, prevention and exploit-protection policies, exclusions governance, and response actions.
Strengthen the technical side of vulnerability operations run by the MSSP: scan coverage and authenticated scanning, risk-based prioritization using exploitability and threat intelligence (CISA KEV, EPSS), correlate vulnerabilities with active threat activity, and automate remediation workflows.
Partner with Cloud, Network, and Identity security engineers to integrate CNAPP, network, and identity signals into detection and response, including identity threat detection for account takeover, MFA fatigue, and AiTM phishing.
Partner with OT Security to extend monitoring and detection into manufacturing in a production-safe manner aligned with ISA/IEC 62443 and NIST SP 800-82.
Author and maintain incident response playbooks, technical run books, and tabletop exercise scenarios; lead technical portions of post-incident reviews to drive corrective actions to closure.
Define, automate, and report operational metrics and KPIs (MTTD, MTTR, ATT&CK detection coverage, false-positive rate, log source health, MSSP escalation quality) to the CISO and Information Security leadership.
Contribute to the security operations roadmap: evaluate emerging capabilities including AI-assisted triage and agentic SOC automation; support platform evaluations, proofs of concept, and TCO analyses.
Provide technical evidence for logging, monitoring, and incident response controls in SOX, C-SOX, PCI-DSS, and other audits, and drive remediation of related findings.
Mentor engineers and transfer knowledge to MSSP analysts on GE Appliances environment, detections, and response procedures.

Requirements

Bachelor’s degree in Information Systems, Cybersecurity, Computer Science, or a related technical field, or equivalent practical experience.
6–10 years progressive experience in IT or information security, including 4+ years hands-on experience in security operations, detection engineering, or incident response in a large enterprise environment.
Deep hands-on experience engineering and administering SIEM/SOAR and EDR/XDR platforms, including writing detection rules and queries (XQL, SPL, KQL), with examples such as Cortex XSIAM/XDR, Splunk, Microsoft Sentinel/Defender, and CrowdStrike.
Proven experience building detection content mapped to MITRE ATT&CK and tuning it for fidelity at enterprise scale.
Experience building SOAR playbooks and integrations; proficiency in Python and/or PowerShell and working with REST APIs and JSON.
Hands-on incident response experience with significant enterprise incidents such as ransomware, BEC, and account takeover, including endpoint, log, and network analysis.
Experience in a MSSP/MDR technical oversight role, including tuning, escalation quality review, and run-book development.
Strong understanding of log sources and telemetry across Windows, Linux, network, cloud (AWS, Azure, and/or GCP), Microsoft 365, and identity providers.
Working knowledge of MITRE ATT&CK, NIST SP 800-61, NIST CSF, and CIS Controls.
Excellent verbal and written communication skills for both technical and executive audiences.

Technologies

Palo Alto Networks Cortex XSIAM/XDR
Splunk
Microsoft Sentinel/Defender
CrowdStrike
XQL, SPL, KQL
Python, PowerShell
REST APIs, JSON
MITRE ATT&CK, SOAR, SIEM, EDR, XDR
Microsoft 365, CNAPP
CISA KEV, EPSS
ISA/IEC 62443, NIST SP 800-82, NIST SP 800-61, NIST CSF
CIS Controls
SOX, C-SOX, PCI-DSS
Detection-as-code, Git, Sigma, Atomic Red Team, MITRE Caldera

Preferred Qualifications

Certifications such as GIAC (GCIH, GCIA, GCDA, GCFA, GCTI), Palo Alto Networks Cortex certifications, CISSP, or similar.
Experience with detection-as-code practices, Git, CI/CD pipelines, and Sigma or other vendor-neutral rule formats.
Experience with threat hunting, purple teaming, and adversary emulation (Atomic Red Team, MITRE Caldera, breach-and-attack simulation platforms).
Familiarity with OT/ICS monitoring frameworks such as ISA/IEC 62443 or NIST SP 800-82.
Experience integrating cloud security (CNAPP/CSPM) and identity telemetry into detection and response.
Experience applying AI and large language models to security operations, with familiarity of AI security frameworks such as MITRE ATLAS and the OWASP Top 10 for LLM Applications.
Experience in manufacturing, critical infrastructure, or global multinational organizations.

Working Conditions

Normal office environment.
Occasional weekend and/or evening work, including after-hours escalation for major security incidents and participation in an on-call rotation.

Location: Louisville, KY (onsite), USA

View full job page →

Today

Cyber Security Engineer

Regions Nashville, TN

Nashville, TN

Today

$89k - $123k/yr Full time Cloud Platforms Cyber Security Engineer Cybersecurity Tools

Apply Now

Job Description

Support security solutions across cloud applications, infrastructure, platforms, and related technologies within the Cyber Security organization at Regions.

Responsibilities

Design, implement, and support relevant cyber security technology solutions
Provide technical administration, including troubleshooting, break-fix support, patching, and day-to-day application activities
Stay current on industry trends and assess organizational objectives and needs
Maintain operational documentation and reports to support monthly trend analysis and project components
Assist with research, proof-of-concept, selection, and implementation of technology solutions; analyze pros and cons and evaluate build vs buy options
Identify opportunities to implement new technologies and methods that improve business processes, efficiency, effectiveness, and customer value
May support security incident response activities and post-event reviews
Partner with subject-matter experts to design, implement, and maintain security solutions for business areas, project teams, and vendors
Participate in evaluating the technology vision, opportunities, challenges, and the impact on security standards within the Cyber Security organization
Support relevant metrics, controls, and governance administration related to cyber security technologies
Participate in on-call rotation for relevant cyber security technologies
Adhere to operational processes, standards, and procedures
Ensure compliance with risk management programs, rules and regulations, and cybersecurity practices; support process improvements and apply disciplined change management practices
May provide guidance and advice to junior engineers

Requirements

High School Diploma or GED
Six (6) years of related post-secondary education and/or experience in Information Security and/or Information Technology

Technologies

CISSP, CompTIA Security+, CCNA, MCSA
RedHat Linux, AIX, Solaris, Oracle Linux, UNIX
IAM, BoKS, CyberArk, Delinea, VAS, SailPoint, Okta
PAM, SUDO, Role Based Access Control
AWS IAM, Azure AD
Python

Skills and Competencies

Ability to interpret and ensure compliance with applicable rules, regulations, and industry guidance
Ability to prioritize conflicting demands
Knowledge of common web technologies, cloud technologies, and enterprise and network architecture
Knowledge of defense in depth, trust levels, privileges, and permissions
Knowledge of modern security tools and controls
Problem-solving skills to develop sound solutions to issues
Strong verbal, written communication, and organizational skills
Strong analytical and evaluative thinking capability

Preferred Qualifications

Bachelor’s degree in Information Technology, Information Security, Information Systems Management, Computer Science, Engineering, or related field
Applicable technology and/or security certifications (e.g., CISSP, CompTIA Security+, CCNA, MCSA)
Experience supporting more than one OS type (RedHat Linux, AIX, Solaris, Oracle Linux, etc.) in an enterprise environment
Advanced understanding of IAM concepts, especially Least Privilege
Experience with at least one UNIX Identity Management solution (BoKS, CyberArk, Delinea, VAS, etc.) preferred
Familiarity with enterprise tools such as SailPoint and Okta, or similar
Advanced understanding of UNIX permissions, file ownership, PAM, user/group management
Understanding of SUDO policies and privilege delegation
User provisioning and deprovisioning processes
Shell scripting experience (Python experience a plus)
Familiarity with Role Based Access Control
Understanding of Cloud IAM concepts (AWS IAM, Azure AD)

Benefits

Paid Vacation/Sick Time
401K with Company Match
Medical, Dental and Vision Benefits
Disability Benefits
Health Savings Account
Flexible Spending Account
Life Insurance
Parental Leave
Employee Assistance Program
Associate Volunteer Program

Position Details

Exempt from timekeeping requirements under the Fair Labor Standards Act; not eligible for overtime pay
Onsite role, now or in the near future
Regular work hours, including full days in the office three or more days a week
Manager sets the work schedule, including in-office expectations
No relocation assistance provided; relocation would be at your expense
Available locations: Birmingham, AL; Atlanta, GA; Nashville, TN; or Charlotte, NC
No work visa sponsorship for this position at this time
Applicants must be currently authorized to work in the United States full-time
May be filled at a higher level depending on qualifications and relevant experience

Compensation

USD 89,329 - 122,940 per year

Location

Riverchase Operations Center, Hoover, Alabama
Nashville, TN (onsite)

View full job page →

Today

Cyber Security Engineer I

Textron Systems Hunt Valley, MD

Hunt Valley, MD

Today

$79k - $119k/yr Full time Cyber Security Engineer Cybersecurity Tools Engineer

Apply Now

Job Description

Textron Systems offers an onsite role in Hunt Valley, MD supporting cybersecurity engineering for technologies used to protect the warfighter. You will work in an engineering environment that uses process to guide day-to-day work, with opportunities to contribute to assessments and authorization efforts aligned to RMF. Flexible work schedules, education support, training for DoDD 8140.01 / DoD 8570.01-M certification, wellness benefits, and company-funded retirement contributions are included.

Compensation: USD 79,300 - 119,000 per year.

Responsibilities

Provide cybersecurity engineering support across next-generation technologies and proven platforms that support and protect the warfighter
Support the Cyber Security team in assessment and authorization activities for products in accordance with Risk Management Framework (RMF), working toward Interim Authorization To Test (IATT) or Authorization To Operate (ATO)
Run and interpret results from vulnerability and compliance efforts using tools such as ACAS, Nessus, EvaluateSTIG, NMAP, and SCC, including in-depth analysis against STIGs and SRGs
Develop remediation and mitigation plans and create implementation packages for those plans
Occasionally travel to support cybersecurity activities (less than 10%)
Work effectively both independently and as part of a cohesive team using established process to manage daily responsibilities

Requirements

Must hold a bachelor’s or master’s degree in computer science/Cybersecurity/Information Assurance/Computer Engineering/Information Systems or a related field
Basic understanding of technical writing
Ability to obtain a U.S. government Secret security clearance
Ability to obtain a DoDD 8140.01 / DoD 8570.01-M IAT II or higher certification (examples include Security+, SSCP, CySA+, CCNA Security, or GSEC) within the first six months following employment

Education, Tools, and Technologies

Work may involve Windows and Linux environments and align with security engineering processes using ACAS, Nessus, EvaluateSTIG, NMAP, SCC, STIGs, SRGs, and RMF, along with certification requirements under DoDD 8140.01 and DoD 8570.01-M.

Benefits

Flexible Work Schedules
Education Assistance
Career Development & Training Opportunities, including support for DoDD 8140.01 / DoD 8570.01-M certification preparation labor, exam, and continuing education (CEU/CPE)
Wellness Program including Fitness Reimbursement
Medical, Dental, Vision & 401(K) with Company Funding
Paid Parental Leave

AI Readiness

Textron Systems expects employees to use AI-enabled tools responsibly and effectively. Candidates should be comfortable learning and applying these tools, evaluating AI-generated output with sound judgment, and using AI in line with company policy and ethical standards. Prior experience with specific tools is not required; curiosity, adaptability, and good judgment are valued.