Senior Cybersecurity Engineer (Trelix) at General Dynamics Information Technology

McLean, Virginia, United States -

Full Time

Start Date

Immediate

Expiry Date

07 Aug, 26

Salary

175950.0

Posted On

09 May, 26

Experience

5 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

Cybersecurity, Endpoint Security, Linux, Splunk Enterprise Security, Trelix, NIST 800-53, RMF, Vulnerability Management, Tenable.sc, STIGs, SIEM, Incident Response, Red Hat Linux, Security Operations, Continuous Monitoring, Audit Preparation

Industry

IT System Data Services

Description

Type of Requisition: Regular Clearance Level Must Currently Possess: Top Secret/SCI Clearance Level Must Be Able to Obtain: Top Secret/SCI Public Trust/Other Required: None Job Family: Cyber and IT Risk Management Job Qualifications: Skills: Cybersecurity, Endpoint Security, Linux, Splunk Enterprise Security Certifications: None Experience: 8 + years of related experience US Citizenship Required: Yes Job Description: Description: We are seeking a highly skilled and multi-faceted Cyber Engineer for a critical contract role supporting Google's SIPRNet enclave. The ideal candidate is a proactive and seasoned professional with extensive, hands-on experience navigating Trelix, Red Hat Linux, the NIST 800-53 Risk Management Framework (RMF) control requirements, and Security Operations for a classified network in a unique commercial cloud setting. This role requires a blend of technical engineering prowess to provide Security Operations support as well as a deep understanding of continuous monitoring control requirements to prepare for security assessments and auditing. You will be a key contributor to our SIPR Enclave team, supporting the SIPR Enclave Lead in RMF activities and the Senior Cyber Engineer in security operations support. How the Cybersecurity Engineer will make an impact: From a RMF perspective, as directed by the SIPR Enclave Lead - Supports maintaining the Continuous Monitoring program, specifically around vulnerability management, endpoint security, auditing, and security alert triage/monitoring. Supports control implementation statement updates, documentation development for plans or procedures, artifact identification for assessments, and body of evidence generation. Supports POAM mitigation and/or remediation activities. From a Security Tools administrative perspective, as directed by the Senior Cyber Engineer, the Engineer - Update and maintain security tool versions (Trelix, etc) Configure, patch, and update the Linux operating systems Monitors the security applications such as Trelix Scanning implementation (Tenable.sc, SCC Tool) SIEM implementation (Splunk) Endpoint security implementation (Trellix) Works with the vendors of the security applications as applicable to maintain security updates, licenses, resolve support issues (e.g., for Tenable plugins), etc. For Endpoint Management: Ensures all hosts can be seen in the endpoint security application with ongoing monitoring and applicable policies applied. Triages all alerts from the tool to ensure activity in the environment is authorized. For insider threat monitoring: Ensures deployment of tool and related modules are performing as intended. Monitors aggregate user data as directed. Designs, develops, tests, and evaluates information system security throughout the systems development life cycle. For the SIEM: Ensure security systems are up to date and implemented. Validate the telemetry from the hosts and security applications are forwarded to the SIEM. Configures alerts for privileged activity that would be conducted in the enclave as well as alerts from security advisories. Triages all alerts from the SIEM to ensure activity in the environment is authorized. Investigates, resolves, and reports security incidents in alignment with the Incident Response Plan. For scanning/STIGs: Ensures the inventory of hosts and recurring/ad-hoc scan policies are accurate. Reviews the scans to confirm correct, actionable data is generated to support the patching activities. Reviews STIG results and supports the team in implementing corrective action as applicable. What you'll need to be successful: Education: BA/BS Degree or equivalent experience in lieu of degree Experience: 8+ years of related experience Ability to use security operations of Trelix. Ability to update security applications, such as Trelix. Experience patching and updating LINUX (or RHEL or Red Hat) Ability to harden the system using STIGs. Ability to update the underlying security tools Linux operating system. Role requirements: Knowledge of the complete NIST SP 800 series (especially 800-37, 800-53, 800-30) and risk management principles. Certifications: Must be DoD 8140 / 8570.01-M compliant (e.g., including but not limited to Security+) Investigation/Clearance Level: Must possess a current and active Top Secret (Sensitive Compartmented Information [SCI] eligibility). Location: Onsite at the classified operations center in McLean, VA. Preferred Qualifications: Hands-on experience with security operations of Splunk. Hands-on experience with Tenable.sc. The likely salary range for this position is $142,792 - $175,950. This is not, however, a guarantee of compensation or salary. Rather, salary will be set based on experience, geographic location and possibly contractual requirements and could fall outside of this range. Scheduled Weekly Hours: 40 Travel Required: 10-25% Telecommuting Options: Onsite Work Location: USA VA McLean Additional Work Locations: Total Rewards at GDIT: Our benefits package for all US-based employees includes a variety of medical plan options, some with Health Savings Accounts, dental plan options, a vision plan, and a 401(k) plan offering the ability to contribute both pre and post-tax dollars up to the IRS annual limits and receive a company match. To encourage work/life balance, GDIT offers employees full flex work weeks where possible and a variety of paid time off plans, including vacation, sick and personal time, holidays, paid parental, military, bereavement and jury duty leave. To ensure our employees are able to protect their income, other offerings such as short and long-term disability benefits, life, accidental death and dismemberment, personal accident, critical illness and business travel and accident insurance are provided or available. We regularly review our Total Rewards package to ensure our offerings are competitive and reflect what our employees have told us they value most. We are GDIT. A global technology and professional services company that delivers consulting, technology and mission services to every major agency across the U.S. government, defense and intelligence community. Our 30,000 experts extract the power of technology to create immediate value and deliver solutions at the edge of innovation. We operate across 50 countries worldwide, offering leading capabilities in digital modernization, AI/ML, Cloud, Cyber and application development. Together with our clients, we strive to create a safer, smarter world by harnessing the power of deep expertise and advanced technology. Join our Talent Community to stay up to date on our career opportunities and events at gdit.com/tc. Equal Opportunity Employer / Individuals with Disabilities / Protected Veterans Join our 30,000 everyday heroes. We are GDIT. A global technology and professional services company that delivers consulting, technology and mission services to every major agency across the U.S. government, defense and intelligence community. Our 30,000 experts extract the power of technology to create immediate value and deliver solutions at the edge of innovation. We operate across 30 countries worldwide, offering leading capabilities in digital modernization, AI/ML, Cloud, Cyber and application development. Together with our clients, we strive to create a safer, smarter world by harnessing the power of deep expertise and advanced technology. For more information about GDIT's Privacy Policy, click here: https://www.gdit.com/privacy-policy/notices/

Responsibilities

The role involves providing security operations support for a classified SIPRNet enclave, focusing on endpoint security and SIEM management. Additionally, the engineer supports the Risk Management Framework (RMF) through continuous monitoring, vulnerability management, and audit preparation.