Bash Scripting, Communication Skills, Computer Security, Customer Support/Service, GPEN - GIAC Penetration Tester, Gap Analysis, Identify Issues, Industry Standards, Information Technology & Information Systems, Linux Operating System, Microsoft Windows Operating System, Python Programming/Scripting Language, Reporting Dashboards, Reporting Skills, Scripting (Scripting Languages), Security Architecture, Security Consulting, Security Information and Event Management (SIEM), Technical Support, Use Cases, Windows PowerShell
The State of South Carolina is looking for a Security Architect - Consultant (Detection Engineer)
Will close to submissions on 06/12 at 5:00PM EST.
Interview Process: 1 round, Virtual/Online - potential for a 2nd round onsite as needed
Duration of the Contract: 12 months
Possibility for Extension: Yes
Work Location: Fully Remote
Candidate Location: No SC residency required. Open to nationwide candidates.
Daily Duties/ Responsibilities: - Review andtune current detection rules within the State SIEM.
- Perform Gap analysis of the currentdetection coverage.
- Develop detection rules/solutions to coverfound Gaps.
- monitor threatintelligence sources for new use cases.
- Work withState SOC analysts to create andtune rules.
- Work withthe State ThreatHunter to identify and remediate detection coverage gaps.
- Document processes, runbooks, and troubleshooting steps related to the SOAR and integrations.
- Coordinate withengineering, SOC, and agency staff as needed to meetgoals.
- Other dutiesas needed.
|
Additional skillsand duties: - Proven experience with detection tuning/development..
- Experience with dashboard creation and reporting.
| Preferred Skills(rank in orderof Importance): - Experience with the PaloAlto Cortex XSIAM platform.
- Deep understanding of Windows/Linux artifacts.
|
- Excellent communication and customer service skillsfor agency- facing engagement.
- Experience in working in multi- tenancy environment
- Experience in multi-agency or enterprise service projects.
| |
Required Education/Certifications: - BACHELOR'S DEGREE IN AN INFORMATION TECHNOLOGY OR INFORMATION SECURITY RELATED FIELD
- EIGHT YEARS OF RELEVANT WORK EXPERIENCE MAY BE SUBSTITUTED IN LIEU OF EDUCATION
- FIVE YEARS OF EXPERIENCE IN SUPPORTING LARGE IT ENVIRONMENTS AND/OR SYSTEM DEPLOYMENTS
- 5+ years of Strong scripting and automation skills (Python, Bash, PowerShell, or similar).
- Understanding of Sigma, YARA,and other industry standard detection languages.
- Familiarity withMITRE ATT&CK framework
| Preferred Education/Certifications: - CISSP, CISA, CISO or equivalent advanced security certification.
- Additional relevant certifications (e.g., CEH, OSCP, GPEN).
- VENDOR CERTIFICATIONS IN DETECTION ENGINEERING.
- Resource is local to Columbia, South Carolina or a surrounding city in South Carolina
|