Senior Systems Engineer

• Shall operate, monitor, sustain, and secure the SIEM using the full capabilities of the application (e.g., logging all security events and performing event analysis).

• The SIEM aggregates data from daily from multiple Army Garrison and tactical network sources, which includes, but is not limited to, Intrusion Protection System, Intrusion Detection Systems, Firewalls, Proxies, Routers, HBSS (Host Based Security System), LEAP (Lower Echelon Analytic Platform), LTAC (Lightweight Tactical Analytic and Compute), Cloud Tactical Data Fabric, GDP (Garrison DCO Platform) and server system logs.
• Shall support SIEM data forwarding through the deployed data broker.
• Other sources may be added (i.e., Active Directory domain controllers, DNS servers, etc.).
• Install updates to event analysis rules sets and analyze operational impact.
• Communicate SIEM storage requirements to maintain approximately 12 months of live security events.
• Maintain and update SIEM tool software rules for optimal detection of malicious or unauthorized activity.
• Develop and maintain SIEM data feeds to the designated Army wide Big Data Platform, currently designated as” Gabriel Nimbus”.
• Develop and document disaster recovery procedures for RCC-P managed sensors, including IPS/IDS, system baseline tools (e.g., ESM), host-based systems and agents, server managers, applications, and remote management systems.
• Store written procedures in the RCC-P Document Management System (DMS) database or another designated document repository.
• Establish and maintain written procedures to set up, track, and document status and location of hardware and software for each baseline of sensors.
• Coordinate with installation NECs or customer points of contact on sensor installation and troubleshooting.
• Maintain points of contact rosters for NECs or NEC-like entities that provide on-site technical support and update rosters as new information is received.
• Other duties as assigned.

• BS degree in Information Technology, Cybersecurity, Data Science, Information Systems, or Computer Science, from an ABET accredited or CAE designated institution.
• Must meet at least one of the following baseline certifications in lieu of education: CISSO, GCIA, GCSA, GCLD, GICSP, CISSP-ISSAP, or CISSP-ISSEP

• Knowledge of network and host monitoring systems; intrusion prevention system/Intrusion Detection System (IPS/IDS), information and SIEM and other sensor systems to monitor, detect, identify, verify, and report.
• Supported the installing, maintaining, deploying, managing, and hardening of multiple types of Enterprise level sensor systems.
• Experience managing NIPRNet, SIPRNet, and MPE sensors.
• Experience performing advanced systems administration for the enterprise sensor mission relative to platform architecture, configuration, lifecycle support, and technology refresh and infusion.
• Experience performing daily backups, implementing system upgrades, and verifying system configurations, accounts, and passwords conform to baseline standards.
• IAW current ChM policy and TTP documentation, all changes related to sensor operation and management shall be routed through the appropriate CCB. All installation and repair history shall be tracked via Remedy, ITSM or as required IAW with approved Change and/or Configuration Management TTP documents.
• Must meet DoD 8140 Enterprise Architect (651).

• Must be a US Citizen.
• Must have an active Secret clearance.

Alaka`ina Foundation