SITEC - Cyber Threat Detection Engineer - MacDill AFB

Peraton requires Cyber Threat DetectionEngineers to support the Special Operation Command Information Technology Enterprise Contract (SITEC) – 3 EOM. 

This position is located at MacDill AFB in Florida.   

The purpose of the Special Operations Forces Information Technology Enterprise Contract (SITEC) 3 Enterprise Operations and Maintenance (EOM) Task Order (TO) is to provide USSOCOM, its Component Commands, its Theater Special Operations Commands (TSOCs), and its deployed forces with Operations and Maintenance (O&M) services to maintain Network Operations (NetOps); maintain systems and network infrastructure; provide end user and common device support; provide configuration, change, license, and asset management; conduct training, and perform Install, Move, Add, Change (IMACs) services. The responsibilities and tasks associated with each requirement play a pivotal role to USSOCOM, the CIO/J6 organization, and ultimately the end-user who operate around the globe 24x7x365. 

The primary objectives of the Cyber Threat Detection Engineer is to develop, implement, and drive continuous improvement of threat detection capabilities and engineering solutions throughout the USSOCOM enterprise. The Cyber Threat Detection Engineer will explore and implement security technologies and methodologies, while also working to modernize existing security infrastructure and processes.

Duties:

• Lead internal and external Purple Team engagements to validate continuous hardening of networks and enable successful detection and response during real-world cybersecurity incidents and Red Team assessments.
• Lead integration of data from multiple security tools to detect complex, multi-step attacks with high accuracy.
• Work with pen testing teams to design and execute realistic attack simulations that test the effectiveness of current detections.
• Create and maintain comprehensive documentation of threat detection rules, processes, and technologies
• Tune and optimize threat detection rules to minimize false positives and ensure accurate detection.
• Regularly update the Sysmon configuration used for endpoint monitoring to reflect evolving threat landscapes, ensuring coverage of new event types and attack techniques aligned with MITRE ATT&CK.

Required Qualifications:

• Min 12 years with HS degree, 10 years with AS/AA degree, 8 years with BS/BA, 6 years with MS/MA
• DoD 8570 IAT II Certification  
• DoD TS/SCI clearance 
• CSSP Incident Response or CSSP Analyst

Desired Qualifications:

• Must be with DoW 8140 compliant under the Work Role Code 531– Cyber Defense Incident Responder - Intermediate level or higher by 1 Oct 26.
• Strong analytical and problem-solving skills
• Ability to communicate security issues clearly to both technical and non-technical stakeholders
• Strong understanding of security technologies used to defend Enterprise networks such as EDR, XDR, IDS, IPS, SIEM and SOAR.
•