Cyber Security Engineer

Shape the future of Zero Trust cybersecurity across the Pacific. 🚀 

SOSi is seeking a Cyber Security Engineer to architect, integrate, and evolve the security ecosystem supporting a mission-critical Command and Control (C2) enterprise serving more than 5,000 users across the INDOPACOM theater. You'll unite SIEM, SOAR, and Linux automation technologies into a streamlined, intelligence-driven platform that delivers actionable telemetry, automated security outcomes, and real-time risk visibility. Working alongside engineers, SOC operators, and senior government leaders, you'll help drive the next generation of cyber resilience and Zero Trust operations.

💥 At SOSi, we tackle complex technical challenges head-on—because Challenge Accepted isn’t just a motto, it’s how we operate💥

Essential Job Duties:

Zero Trust engineering

• Assess, design and maintain the roadmap for security capabilities aligned to the DoD Zero Trust Reference Architecture and Target-level activities across all seven pillars.

• Translate Zero Trust requirements into concrete configurations, segmentation rules and policies, and document how each control maps to the architecture.

• Evaluate, pilot and integrate new security technologies to close Zero Trust capability gaps.

SIEM, telemetry and analytics

• Design, deploy and tune SIEM Security, including Agent policies, integrations, index lifecycle management, data tiers and cluster sizing.

• Engineer security data pipelines that collect, filter, enrich and normalize data to a Common Schema before it reaches the SIEM, controlling volume and cost.

• Develop, test and tune detection rules, dashboards and alerts mapped to MITRE ATT&CK, reducing false positives in partnership with the SOC.

Security orchestration, automation and response (SOAR)

• Design, deploy and maintain the SOAR platform and its integrations with the SIEM, endpoint, vulnerability, identity, network and ticketing systems.

• Build and test playbooks for alert triage, enrichment, containment (e.g., isolating hosts, disabling accounts) and case management, with human approval gates where required.

• Support the Automation and Orchestration pillar of the DoD Zero Trust strategy, including policy decision and enforcement integration.

Endpoint security

• Engineer and harden enterprise endpoint protection and EDR platforms, including DoD-mandated endpoint security solutions, covering policy, host intrusion prevention and device control.

• Maintain agent health, deployment coverage and policy compliance across Windows and Linux endpoints, and forward endpoint telemetry into the SIEM.

Vulnerability management

• Operate and optimize enterprise vulnerability scanning in line with DoD requirements (e.g., ACAS), including credentialed scan design, scan zones and reporting.

• Drive remediation by correlating findings with asset owners and patch status, tracking IAVM compliance and producing risk-based remediation priorities.

Linux engineering and compliance

• Engineer, build and maintain the enterprise Linux server infrastructure, including standard hardened builds, identity integration, performance and availability, upgrades and lifecycle replacement

• Engineer Linux content lifecycle, patching and errata workflows to deliver timely, tested updates across environments.

• Automate STIG and SCAP compliance with configuration-as-code, and report compliance status to leadership.

Compliance, risk and reporting

• Implement and validate STIGs and SRGs, and produce RMF artifacts, POA&Ms and evidence for assessments and inspections (e.g., CORA).

• Interact with vendors, other agencies and coalition partners on behalf of the program. 

• Contribute to After Action Reports (AARs) and submit Weekly Activity Reports (WARs) in accordance with contract requirements.