Job ID: 2508288
Location: REMOTE WORK, TN, US
Date Posted: 2025-08-05
Category: Cyber
Subcategory: Cybersecurity Spec
Schedule: Full-time
Shift: Day Job
Travel: No
Minimum Clearance Required: None
Clearance Level Must Be Able to Obtain: Secret
Potential for Remote Work: Yes
Description
We provide advanced cybersecurity monitoring and engineering support to a wide range of government agencies through a multi-tenant MSS model. Our Security Operations Center (SOC) operates 24/7, leveraging Microsoft Sentinel as the core SIEM platform. However, we increasingly support hybrid and multi-cloud environments including AWS and Splunk, and we are seeking a cloud-savvy SIEM engineer to help us grow and maintain secure, scalable monitoring capabilities.
As a SOC SIEM/Cloud Engineer, you will serve as one of the primary engineers for multi-cloud SIEM operations in a managed security services environment. While Microsoft Sentinel remains our core SIEM platform, you will also support AWS-native security tooling and Splunk-based environments. This role emphasizes cross-cloud log ingestion, automation, and security detection engineering. Candidates must be self-directed, security-minded, and comfortable designing scalable monitoring strategies across diverse architectures.
This is a remote position, but Secret clearance eligibility is required to support future classified operations, as needed.

REQUIRED QUALIFICATIONS

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or related field
• 3–5+ years of SIEM engineering experience across multi-cloud environments (Azure, AWS)
• Hands-on experience with Microsoft Sentinel, AWS Security Services, and Splunk
• Experience creating alerts and detection rules in KQL, SPL, and JSON-based formats
• Familiarity with automation tools such as Logic Apps, Splunk SOAR, AWS Lambda, or Step Functions
• Strong scripting knowledge (PowerShell, Python, or Bash)
• Must be a U.S. citizen and clearable to the Secret level

PREFERRED QUALIFICATIONS

• Active Secret clearance or higher
• Microsoft Certifications: SC-200, AZ-500
• AWS Certifications: Security Specialty, Solutions Architect Associate or Pro
• Splunk Certifications: Admin, Power User
• Experience with cloud container security (EKS, AKS, Kubernetes auditing)
• Experience in multi-tenant MSSP environments or government contracts
• Familiarity with large language models (LLMs), GenAI, or agentic AI frameworks for use in cybersecurity operations