Peraton is seeking an experienced and highly skilled Security Engineer to join our growing security team. The ideal candidate will bring years of hands-on experience in designing, implementing, and managing security solutions in a large, multi-tenant environment. In particular, this individual will have deep expertise in cloud security technologies, specifically within Azure and AWS environments, as well as experience with key security tools such as CrowdStrike, Splunk, and Tenable I.O.. Experience with additional EDR, SIEM, or vulnerability assessment tools is highly preferred.
The Security Engineer will be responsible for securing and monitoring cloud-based infrastructures, managing endpoint security solutions, and working with vulnerability management tools to ensure the organization’s security posture is robust and proactive. This is an excellent opportunity for a seasoned security professional with a strong background in networking, application security, and security operations to make a meaningful impact on a large-scale enterprise environment.
Day to Day Work Responsibilities:
- Cloud Security:
- Design, implement, and manage security controls in AWS and Azure cloud environments, including identity and access management (IAM), encryption, networking security, and monitoring.
- Ensure cloud security best practices are followed and leverage native security tools (e.g., AWS Security Hub, Azure Security Center) alongside third-party solutions.
- Implement cloud infrastructure security monitoring, ensure proper segmentation and access control policies, and safeguard cloud workloads and data.
- EDR and Endpoint Security:
- Hands-on configuration, management, and troubleshooting of CrowdStrike (or other endpoint detection and response tools), ensuring optimal endpoint protection across the enterprise.
- Work with internal teams to monitor and respond to security alerts, review threat intelligence data, and escalate or remediate incidents as necessary.
- Tune EDR systems to improve detection capabilities, reduce false positives, and enhance incident response effectiveness.
- SIEM Management and Incident Response:
- Administer, configure, and maintain Splunk or other SIEM platforms for comprehensive event logging, correlation, and analysis.
- Develop and tune Splunk queries and dashboards to enhance visibility into security events and incidents.
- Support incident response by leveraging SIEM data to investigate alerts, conduct forensics, and assist in the triage and resolution of security incidents.
- Vulnerability Management:
- Implement and manage vulnerability assessment tools, primarily Tenable I.O., to perform scans and identify weaknesses across enterprise systems, applications, and networks.
- Collaborate with vulnerability management teams to prioritize and remediate vulnerabilities, track mitigation efforts, and verify that vulnerabilities are properly addressed.
- Security Architecture and Design:
- Work closely with architecture and development teams to design secure systems, applications, and networks, with a focus on preventing vulnerabilities and improving system resilience.
- Provide security input and guidance during the development lifecycle, ensuring secure coding practices and the proper use of security controls.
- Network Security:
- Apply your expertise in network security to configure and maintain secure network architectures, including firewalls, VPNs, proxies, and intrusion detection/prevention systems (IDS/IPS).
- Work to detect, prevent, and respond to network-based threats and anomalies.
- Understand and implement network segmentation, micro-segmentation, and secure access policies to minimize attack surfaces.
- Automation and Integration:
- Automate repetitive security tasks, improve security operations workflows, and integrate security solutions to streamline monitoring, alerting, and incident response.
- Implement and manage security orchestration, automation, and response (SOAR) solutions to improve incident detection and response times.
- Security Monitoring and Threat Intelligence:
- Continuously monitor cloud and on-premise infrastructures, endpoints, and networks for threats using advanced security monitoring tools.
- Analyze threat intelligence feeds to identify emerging risks and proactively implement measures to defend against new attack vectors.
- Stay updated on the latest threat trends, vulnerabilities, and exploit techniques, and share knowledge with other team members.
- Collaboration and Documentation:
- Work closely with cross-functional teams (engineering, IT, operations, etc.) to ensure security best practices are integrated throughout the organization's systems, applications, and processes.
- Maintain detailed documentation of security architecture, configurations, processes, and incident reports for audit and compliance purposes.
- Provide training, mentorship, and guidance to junior security team members.
