Make an impact on cyber readiness by leading the infrastructure that supports a Cyber Security Operations Center (CSOC). This on-site role in Tampa, FL blends hands-on security engineering with operational accountability across enterprise firewalls, cloud-based isolation, network detection, and centralized visibility. You will work with cutting-edge technology and help maintain dependable protections for digital assets against evolving threats.
This position offers a likely salary range of $144,500 to $195,500 and includes a 401(k) with company match, comprehensive health and wellness packages, paid vacation and holidays, and professional growth support including paid education and certifications. An internal mobility team is also available to help you take ownership of your career.
What you’ll do
Serve as a lead cybersecurity infrastructure engineer providing cyber technical support for the CSOC. You will configure, tune, optimize, and maintain core security capabilities, ensuring operational effectiveness and architecture alignment across multiple platforms and data pipelines.
- Own configuring, tuning, optimizing, and maintaining critical security infrastructure to safeguard organizational digital assets.
- Oversee operations and maintenance of essential systems, including enterprise firewalls and boundary protection controls.
- Oversee operations for Cloud-based Internet Isolation (CBII) / Remote Browser Isolation (RBI) platforms.
- Oversee operations for IDS/IPS sensors built on Security Onion (including Suricata and Zeek).
- Oversee operations for network packet brokers and visibility fabric using Gigamon TAPs.
- Oversee operations for SIEM technologies, including Splunk.
- Oversee operations for EDR systems and NAC policies (Network Access Control).
- Oversee operations for SOAR platforms (Security Orchestration, Automation, and Response).
- Deploy and maintain clustered Splunk SIEM environments, including search queries, dashboards, and correlation alerts.
- Fine-tune EDR policies, sensor configurations, and scanning parameters to maintain comprehensive host visibility.
- Ingest and normalize logs from firewall, Gigamon metadata, Security Onion alerts, CBII telemetry, and endpoint sensors into SIEM and central monitoring stacks.
- Perform preventative maintenance including software upgrades, firmware updates, OS patching, and performance tuning across firewalls, Gigamon appliances, Security Onion sensors, and central management servers.
- Monitor throughput, tap drop rates, sensor health, and resource utilization to support continuous, zero-blind-spot visibility.
- Provide tiered escalation support and troubleshooting for incidents impacting boundary protections, isolation sessions, or sensor pipelines, coordinating with hardware and software vendors as needed.
- Conduct system audits and vulnerability assessments of security tools, implementing remediation and hardening benchmarks (including DISA STIGs).
- Prepare technical briefings and capability demonstrations for the CSOC and program leadership.
- Develop, document, and enforce SOPs, configuration baselines, and security policies for firewalls, sensor tap points, and isolated browser workflows in alignment with DoD and agency guidelines.
- Collaborate with audit and compliance teams to support FISMA/DoD compliance mandates and RMF controls.
- Integrate network detection platforms (Security Onion, firewalls) with SOAR to trigger automated enrichment, dynamic IP blocking, and containment workflows.
- Design, implement, and maintain custom SOAR playbooks to accelerate CSOC triage for high-fidelity alerts from boundary and IDS appliances.
- Author engineering documentation including network architecture diagrams and operational runbooks for firewall rules, Gigamon map configurations, and Security Onion deployments.
- Train and mentor CSOC Tier 1/2 analysts on querying network metadata (Zeek), evaluating IDS alerts (Suricata), and interpreting isolation session telemetry.
- Foster cross-functional collaboration and knowledge sharing within the cybersecurity engineering team.
What you’ll need
- Bachelor’s degree in Information Systems, Computer Science, Computer Engineering, Cybersecurity, or a related field (relevant work experience may be considered in lieu of a degree).
- Applicable DoD 8140 or DoD 8570 certification (examples listed: Security+ CE, CySA+, CASP+, CISSP, or relevant CSSP role certifications).
- 5+ years of experience in cybersecurity infrastructure administration and engineering, including hands-on focus in configuring and managing:
- Next-generation firewalls (NGFW) and boundary security policies.
- Cloud-based Internet Isolation (CBII) and web proxy solutions.
- IDS/IPS sensors via Security Onion, plus network visibility fabrics using Gigamon hardware or virtual TAPs.
- SIEM, EDR, NAC, and SOAR platforms.
- Security Clearance Level: TS/SCI (Top Secret/SCI).
- U.S. Citizenship Required.
- Location: on-site in Tampa, Florida.
- Proficiency in Linux environments (RHEL, Ubuntu/Debian) including system administration, package management, and shell scripting (Bash, Python) for automation and log pipeline customization.
- Deep understanding of TCP/IP networking, packet analysis, traffic aggregation, filtering, and flow distribution using packet brokers and TAP infrastructure.
- Hands-on expertise managing and tuning Security Onion architecture, including Suricata signature tuning, Zeek network analysis, and sensor deployment.
- Robust knowledge of NGFW rule base management, NAT policies, SSL/TLS inspection, and perimeter access controls.
- Experience administering CBII or Secure Web Gateways (SWG).
- Solid understanding of cybersecurity principles, MITRE ATT&CK, threat vectors, and detection engineering best practices across perimeter, network, and endpoint tools.
- Strong analytical skills for troubleshooting packet drops, routing, sensor capture, and tool pipeline performance issues.
- Excellent communication and collaboration skills, with the ability to work independently, prioritize operational tasks, and meet deliverables in a dynamic CSOC environment.
Key technologies
- Security Onion, Suricata, Zeek, Gigamon
- SIEM (Splunk), EDR, NAC, SOAR
- CBII, RBI, IDS/IPS, Network packet brokers, Visibility fabric
- TCP/IP, Linux (RHEL, Ubuntu, Debian), Bash, Python, SSL/TLS
- MITRE ATT&CK, FISMA, RMF, DISA STIGs
- Wireshark, PCAP
Additional details
- Requisition: RQ232148 (Regular)
- Category: Cyber and IT Risk Management
- Travel required: Less than 10%
- Public Trust: None
Identity verification process
Applicants must complete an identity verification process using advanced biometrics and artificial intelligence, which may include being on camera during virtual interviews and authorizing collection, processing, and use of biometric data for identity verification and security purposes.
