Cyber Security Engineer

Company Description
Founded in 1989 and headquartered in Reston, Virginia, SOSi is a private defense and government solutions business specializing in advanced technology systems and mission support. Its capabilities include data science, software development, network engineering, intelligence, surveillance, and reconnaissance (ISR), and logistics.
Job Description
Shape the future of Zero Trust cybersecurity across the Pacific.
SOSi is seeking a Cyber Security Engineer to architect, integrate, and evolve the security ecosystem supporting a mission-critical Command and Control (C2) enterprise serving more than 5,000 users across the INDOPACOM theater. You'll unite SIEM, SOAR, and Linux automation technologies into a streamlined, intelligence-driven platform that delivers actionable telemetry, automated security outcomes, and real-time risk visibility. Working alongside engineers, SOC operators, and senior government leaders, you'll help drive the next generation of cyber resilience and Zero Trust operations.
At SOSi, we tackle complex technical challenges head-on-because Challenge Accepted isn't just a motto, it's how we operate
Essential Job Duties:
Zero Trust engineering

• Assess, design and maintain the roadmap for security capabilities aligned to the DoD Zero Trust Reference Architecture and Target-level activities across all seven pillars.
• Translate Zero Trust requirements into concrete configurations, segmentation rules and policies, and document how each control maps to the architecture.
• Evaluate, pilot and integrate new security technologies to close Zero Trust capability gaps.

SIEM, telemetry and analytics

• Design, deploy and tune SIEM Security, including Agent policies, integrations, index lifecycle management, data tiers and cluster sizing.
• Engineer security data pipelines that collect, filter, enrich and normalize data to a Common Schema before it reaches the SIEM, controlling volume and cost.
• Develop, test and tune detection rules, dashboards and alerts mapped to MITRE ATT&CK, reducing false positives in partnership with the SOC.

Security orchestration, automation and response (SOAR)

• Design, deploy and maintain the SOAR platform and its integrations with the SIEM, endpoint, vulnerability, identity, network and ticketing systems.
• Build and test playbooks for alert triage, enrichment, containment (e.g., isolating hosts, disabling accounts) and case management, with human approval gates where required.
• Support the Automation and Orchestration pillar of the DoD Zero Trust strategy, including policy decision and enforcement integration.

Endpoint security

• Engineer and harden enterprise endpoint protection and EDR platforms, including DoD-mandated endpoint security solutions, covering policy, host intrusion prevention and device control.
• Maintain agent health, deployment coverage and policy compliance across Windows and Linux endpoints, and forward endpoint telemetry into the SIEM.

Vulnerability management

• Operate and optimize enterprise vulnerability scanning in line with DoD requirements (e.g., ACAS), including credentialed scan design, scan zones and reporting.
• Drive remediation by correlating findings with asset owners and patch status, tracking IAVM compliance and producing risk-based remediation priorities.

Linux engineering and compliance

• Engineer, build and maintain the enterprise Linux server infrastructure, including standard hardened builds, identity integration, performance and availability, upgrades and lifecycle replacement
• Engineer Linux content lifecycle, patching and errata workflows to deliver timely, tested updates across environments.
• Automate STIG and SCAP compliance with configuration-as-code, and report compliance status to leadership.

Compliance, risk and reporting

• Implement and validate STIGs and SRGs, and produce RMF artifacts, POA&Ms and evidence for assessments and inspections (e.g., CORA).
• Interact with vendors, other agencies and coalition partners on behalf of the program.
• Contribute to After Action Reports (AARs) and submit Weekly Activity Reports (WARs) in accordance with contract requirements.

Qualifications
Minimum Requirements

• Active, in-scope Top Secret clearance with SCI eligibility, and a valid US passport.
• Bachelor's degree in Cyber Security, Computer Science, Information Systems, Computer Engineering or a related field and 5+ years of experience OR 9+ years of cybersecurity engineering experience in DoD or classified environment.
• 3+ years hands-on engineering (deploying, tuning and integrating, not only operating) with at least three of: SIEM (Elastic preferred), SOAR, security data pipelines, EDR, enterprise vulnerability management, and Linux configuration and patch management.
• DoD 8570 IAT-II compliant (Security+ CE, CCNA, CND, CySA+, GICSP, GSEC, or SSCP).
• Working knowledge of Zero Trust concepts, the DoD Zero Trust Reference Architecture, and tiered or privileged access models.
• Solid administration skills in Linux and Windows Server, including Active Directory, Kerberos, PKI and DNS fundamentals.
• Experience implementing STIGs and SRGs, SCAP scanning and RMF documentation in DoD environments.
• Scripting or automation in at least one of Python, PowerShell, Bash or Ansible, including REST API integrations.
• Clear written and verbal communication, including the ability to brief technical topics to senior leadership.

Preferred qualifications

• Hands-on engineering experience across all the capability areas above, including building SOAR playbooks in production.
• Elastic certifications (Elastic Certified Engineer or Analyst) and vendor certifications for the SOAR, EDR, data pipeline or vulnerability management platforms in use.
• Red Hat certifications (RHCSA or RHCE), and experience with Linux identity management integrated with Active Directory trusts.
• Experience designing detections with MITRE ATT&CK and building SOC workflows and metrics.
• Experience with privileged access workstations (PAWs), tiered or ESAE-style administration, and phishing-resistant MFA (CAC/PIV).
• Familiarity with Data Centric Security, NSA CSfC capability packages and Cross Domain Solutions (CDS).
• Experience with virtualization and hyperconverged platforms from a security-hardening perspective.

Additional Information
Work Environment

• Working conditions are normal for an office environment.
• Mission operations supporting a 24/5 baseline with potential evening, overnight, weekend, exercise, contingency, and surge coverage based on contract and mission requirements.
• Fast paced, deadline-oriented environment.

Working at SOSi
All interested individuals will receive consideration and will not be discriminated against for any reason.