Cyber Security Engineer

Benefits:

401(k)

401(k) matching

Dental insurance

Health insurance

Paid time off

Profit sharing

Training & development

Tuition assistance

Vision insurance

SarelaTech is seeking a Cybersecurity Engineer to support the Defense Logistics Agency (DLA) Enterprise Cyber Security Service Provider (CSSP). The selected candidate will provide technical expertise in the development, implementation, and enhancement of enterprise cybersecurity detection capabilities by designing advanced threat detection use cases, developing SIEM content, and improving cybersecurity monitoring and analytics across government enterprise environments.

Working closely with cybersecurity operations personnel, Threat Detection Analysts, system administrators, cybersecurity tool Subject Matter Experts (SMEs), and government stakeholders, the Cybersecurity Engineer will develop detection logic, automate security processes, enhance SIEM functionality, and improve enterprise visibility into emerging cyber threats while supporting the confidentiality, integrity, availability, and resilience of DLA information systems.

Primary Responsibilities

Research, develop, and implement new cybersecurity threat detection use cases based on emerging threats, threat intelligence, and Threat Detection Analyst recommendations.

Design, develop, and maintain SIEM correlation rules, analytics, dashboards, and detection content to improve enterprise threat detection and monitoring capabilities.

Develop and maintain automation scripts using PowerShell, Python or similar scripting languages to enhance SIEM functionality and streamline cybersecurity operations.

Analyze log sources and data quality to identify gaps in visibility, improve event collection, and optimize enterprise cybersecurity monitoring.

Collaborate with government stakeholders, cybersecurity tool SMEs, and operational teams to identify critical systems, prioritize monitoring requirements, and develop tailored detection signatures.

Evaluate cybersecurity architectures, network traffic, and security telemetry to identify deficiencies in detection capabilities and recommend improvements.

Support continuous improvement of cybersecurity monitoring capabilities by implementing detection methodologies aligned with the MITRE ATT&CK framework and Defense-in-Depth principles.

Prepare technical documentation, implementation guides, operational procedures, and engineering recommendations supporting cybersecurity tool enhancements.

Required Qualifications

Active DoD Top Secret security clearance with SCI eligibility and IT-I access.

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Computer Engineering, or related discipline, or equivalent experience.

Minimum five (5) years of relevant Information Technology experience.

Minimum three (3) years of experience working with a SIEM in a content development, threat detection, or Incident Response role.

Minimum three (3) years of experience as a System Administrator and/or Network Administrator.

Experience developing SIEM correlation rules, threat detection content, or cybersecurity analytics using SPL and KQL query languages.

Strong understanding of enterprise network architecture, cybersecurity monitoring, and log analysis.

Experience developing automation scripts using PowerShell, Python or similar scripting languages.

Strong written and verbal communication skills

Desired Qualifications

Experience supporting the Defense Logistics Agency (DLA), DISA, or other DoD cybersecurity organizations.

Experience supporting Security Operations Center (SOC), Cyber Security Service Provider (CSSP), or Incident Response operations.

Experience working with Splunk Enterprise Security or other enterprise SIEM platforms.

Knowledge of the MITRE ATT&CK framework, Cyber Kill Chain, NIST SP 800-53, NIST SP 800-61, and DISA STIGs.

Experience integrating threat intelligence into SIEM detection content.

Experience developing custom detection signatures, dashboards, automation workflows, or security analytics.

Experience evaluating enterprise log sources, telemetry quality, and security monitoring effectiveness.

Certifications

Required

DoD 8570 IAT Level II certification (Security+, CySA+, SSCP, GSEC, CCNA, GICSP, or equivalent).

DoD 8570 CSSP certification meeting CSSP-IR or CSSP-A requirements.

Preferred

Splunk Core Certified Power User

Splunk Enterprise Security Certified Administrator

GIAC Certified Incident Handler (GCIH)

GIAC Certified Intrusion Analyst (GCIA)

GIAC Certified Enterprise Defender (GCED)

Certified Ethical Hacker (CEH)

Preferred Skills

SIEM engineering and content development

Threat detection engineering

Security analytics

Threat intelligence integration

MITRE ATT&CK framework

Incident Response

Splunk Enterprise Security

Log management and normalization

PowerShell, Python, SPL scripting

Enterprise network architecture

Cybersecurity automation

Technical documentation and engineering design

NIST and DoD cybersecurity standards