Principal Cyber Security Engineer

MANTECH is hiring a Principal Cyber Security Engineer to support mission-critical cybersecurity operations in Chantilly, VA (onsite).

Responsibilities

• Troubleshoot new and existing data collection issues to keep security-relevant data ingestion accurate and reliable
• Diagnose and resolve system issues that affect stability, performance, or usability
• Deploy, manage, and maintain supported and unsupported Splunk Add-ons needed for specific data sources
• Develop and maintain documentation and artifacts, including:
  • Body of Evidence (BOE) artifacts
  • Engineering documentation
  • Change management records
  • System security plans
  • Accreditation materials
• Create a comprehensive Splunk deployment document covering production specifications, deployment methods, and architectural considerations
• Implement and maintain role-based access control so data is available on a validated need-to-know basis
• Design and deploy Splunk forwarders using centralized configuration management through the Splunk Deployment Server

Requirements

• Bachelor’s degree, or 4+ additional years of cyber experience in lieu of a degree
• 7+ years of experience in a cybersecurity role
• Experience with Security Information and Event Management (SIEM) platforms and/or Splunk
• Knowledge of Linux systems administration, general OS security practices, TCP/IP networking, and network security concepts
• Knowledge of Certification and Accreditation (C&A) processes
• Knowledge of DoD policy and technical security guidance for information systems
• DoD Directive 8570.1 IAT Level II or higher certification, or ability to obtain within six (6) months

Technologies

• Splunk
• Splunk Add-ons
• Splunk forwarders
• Splunk Deployment Server
• Security Information and Event Management (SIEM)
• Linux
• TCP/IP

Preferred Qualifications

• Experience with Linux distributions, including Red Hat and CentOS
• Experience with AWS or other cloud environments
• Knowledge of ICS 500-27 audit collection requirements
• Familiarity with:
  • Enterprise Security Services
  • Host Based Security Services
  • Enterprise Vulnerability Scanning Services
  • User Activity Monitoring (UAM)
• Ability to modify feed creation to ingest customer logs in standardized formats to meet policy and compliance requirements
• Splunk certification

Clearance Requirements

• Active TS/SCI with Polygraph required

Physical Requirements

• Must be able to remain in a stationary position 50% of the time
• Occasionally moves about inside the office to access file cabinets, office machinery, or to communicate with co-workers, management, and customers via email, phone, or virtual communication, which may include delivering presentations