Cyber Security Engineer

Description

Join the ES&S team as we craft the future of voting in the United States! On our team, you will push boundaries to provide solutions that meet the industry's ever-evolving needs. Our people apply their innovative perspective to challenges big and small, and ES&S provides the resources to make our employees' vision a reality.

A Cyber Security Engineer at ES&S designs, implements, maintains, and improves enterprise cybersecurity technologies and controls that protect the organization's systems, networks, applications, and data. This position serves as a technical security resource supporting security monitoring, threat detection, incident response, vulnerability management, security architecture, and the development and maintenance of cybersecurity policies and standards. Ideal candidates will have 3+ years of progressive cybersecurity experience in the following areas:

Azure Security Services

• Hands-on experience administering and configuring Microsoft Sentinel within Microsoft Azure.
• Experience creating and managing Data Collection Rules (DCRs), Log Analytics Workspaces, Azure Monitor Agent (AMA), and Logic Apps.
• Experience configuring Sentinel data connectors using built-in Content Hub solutions and custom data connectors.
• Knowledge of onboarding and managing Syslog, CEF, API, and custom log data sources.
• Experience creating DCR transformations and custom tables to filter, parse, transform, and route security telemetry.
• Knowledge of monitoring data ingestion and storage consumption, including managing data across Analytics and Data Lake tiers to optimize storage and cost.
• Experience creating Sentinel Workbooks to visualize security metrics, ingestion trends, data statistics, and operational performance.
• Strong working knowledge of Kusto Query Language (KQL) for data analysis, troubleshooting, reporting, and advanced threat hunting.

Microsoft Defender XDR

• Hands-on experience supporting and administering Microsoft Defender XDR, including incident and alert management, investigation, and response.
• Experience using Advanced Hunting and KQL to investigate threats, analyze security telemetry, and identify potentially malicious activity across endpoints, identities, email, and cloud services.
• Experience with Exposure Management and Vulnerability Management, including identifying, tracking, and prioritizing vulnerabilities and CVEs for remediation.
• Experience onboarding Windows endpoints and servers into Microsoft Defender for Endpoint, validating sensor health, and troubleshooting onboarding and connectivity issues.
• Working knowledge of Attack Surface Reduction (ASR) rules, including configuration, audit/enforcement modes, exclusions, testing, and troubleshooting.
• Experience configuring and managing alert suppression and tuning to reduce false positives and improve security operations efficiency.
• Experience investigating incidents and performing endpoint response and containment actions through Microsoft Defender XDR.
• Preferred experience using Microsoft Sentinel with Microsoft Defender XDR's unified security operations experience, including incidents, hunting, analytics, investigation, and response across both platforms.

Splunk Enterprise Cloud

• Hands-on experience with Splunk Enterprise Cloud and onboarding new security and operational data sources.
• Experience configuring and managing data inputs, including HTTP Event Collector (HEC).
• Working knowledge of indexes, source types, data inputs, and data ingestion concepts.
• Fundamental knowledge of Search Processing Language (SPL) for searching, filtering, analyzing, and reporting on data.
• Experience validating and troubleshooting data ingestion, parsing, indexing, and source-type assignments.
• Experience creating and scheduling Splunk searches and reports for security monitoring, operational reporting, and data analysis.

Cisco XDR Security Technologies

• Preferred hands-on experience with Cisco XDR, including integrating Cisco and third-party security products to ingest and correlate security telemetry.
• Experience performing security investigations in Cisco XDR, including reviewing detections, investigating affected assets, and using available response actions to support threat containment and remediation.
• Working knowledge of Cisco Umbrella SIG and Cisco Secure Access, including troubleshooting security policies, web access, DNS, proxy, and connectivity issues.
• Understanding of SSL/TLS inspection, including certificate-based decryption, policy exclusions, certificate trust issues, and troubleshooting encrypted traffic inspection.
• Understanding of Remote Browser Isolation (RBI) and how browser isolation can be used to reduce risk from potentially malicious or untrusted web content.
• Experience troubleshooting security integrations and validating that telemetry from Cisco and third-party security platforms is successfully flowing into the appropriate monitoring and investigation platforms.

Governance, Risk, and Compliance (GRC)

• Working knowledge of information security principles, including the Confidentiality, Integrity, and Availability (CIA) triad, and the ability to apply these principles when performing security and risk assessments.
• Experience performing information security assessments, identifying security gaps, documenting risks, and recommending appropriate controls and remediation activities.
• Working knowledge of the NIST Cybersecurity Framework (CSF) and the ability to use NIST guidance as a reference when developing, reviewing, and maintaining information security policies and standards.
• Understanding of risk management principles, including risk identification, assessment, prioritization, treatment, acceptance, and ongoing monitoring.
• Knowledge of security lifecycle management, including identifying and managing risks associated with aging technologies, end-of-life systems, unsupported software, and compensating controls.
• Familiarity with commonly used security frameworks and standards, including NIST CSF, NIST SP 800-series guidance, CIS Controls, and ISO/IEC 27001.
• Ability to translate technical security findings into business risk, including documenting impact, likelihood, remediation recommendations, compensating controls, and residual risk.
• Experience supporting risk registers, security exceptions, risk acceptance, remediation tracking, and security control assessments.

Travel: Up to 10% travel is anticipated.

EEO Statement: To provide equal employment and advancement opportunities to all individuals, employment decisions at ES&S will be based on merit, qualifications, and abilities. ES&S does not discriminate in employment opportunities or practices based on race, creed, color, religion, sex, sexual orientation, national origin, citizenship status, marital status, age, disability, genetic information, or because of past, current, or future military obligations or any other characteristics protected by law.

This policy governs all aspects of employment, including selection, job assignment, compensation, discipline, termination, and access to benefits and training.