Cyber Security Engineer

Join the ES&S team as we craft the future of voting in the United States! On our team, you will push boundaries to provide solutions that meet the industry’s ever-evolving needs. Our people apply their innovative perspective to challenges big and small, and ES&S provides the resources to make our employees’ vision a reality.

A Cyber Security Engineer at ES&S designs, implements, maintains, and improves enterprise cybersecurity technologies and controls that protect the organization’s systems, networks, applications, and data.

This position serves as a technical security resource supporting security monitoring, threat detection, incident response, vulnerability management, security architecture, and the development and maintenance of cybersecurity policies and standards. Ideal candidates will have 3+ years of progressive cybersecurity experience in the following areas:

Azure Security Services

• Hands-on experience administering and configuring Microsoft Sentinel within Microsoft Azure.
• Experience creating and managing Data Collection Rules (DCRs), Log Analytics Workspaces, Azure Monitor Agent (AMA), and Logic Apps.
• Experience configuring Sentinel data connectors using built-in Content Hub solutions and custom data connectors.
• Knowledge of onboarding and managing Syslog, CEF, API, and custom log data sources.
• Experience creating DCR transformations and custom tables to filter, parse, transform, and route security telemetry.
• Knowledge of monitoring data ingestion and storage consumption, including managing data across Analytics and Data Lake tiers to optimize storage and cost.
• Experience creating Sentinel Workbooks to visualize security metrics, ingestion trends, data statistics, and operational performance.
• Strong working knowledge of Kusto Query Language (KQL) for data analysis, troubleshooting, reporting, and advanced threat hunting.

Microsoft Defender XDR

• Hands-on experience supporting and administering Microsoft Defender XDR, including incident and alert management, investigation, and response.
• Experience using Advanced Hunting and KQL to investigate threats, analyze security telemetry, and identify potentially malicious activity across endpoints, identities, email, and cloud services.
• Experience with Exposure Management and Vulnerability Management, including identifying, tracking, and prioritizing vulnerabilities and CVEs for remediation.
• Experience onboarding Windows endpoints and servers into Microsoft Defender for Endpoint, validating sensor health, and troubleshooting onboarding and connectivity issues.
• Working knowledge of Attack Surface Reduction (ASR) rules, including configuration, audit/enforcement modes, exclusions, testing, and troubleshooting.
• Experience configuring and managing alert suppression and tuning to reduce false positives and improve security operations efficiency.
• Experience investigating incidents and performing endpoint response and containment actions through Microsoft Defender XDR.
• Preferred experience using Microsoft Sentinel with Microsoft Defender XDR's unified security operations experience, including incidents, hunting, analytics, investigation, and response across both platforms.

Splunk Enterprise Cloud

• Hands-on experience with Splunk Enterprise Cloud and onboarding new security and operational data sources.
• Experience configuring and managing data inputs, including HTTP Event Collector (HEC).
• Working knowledge of indexes, source types, data inputs, and data ingestion concepts.
• Fundamental knowledge of Search Processing Language (SPL) for searching, filtering, analyzing, and reporting on data.
• Experience validating and troubleshooting data ingestion, parsing, indexing, and source-type assignments.
• Experience creating and scheduling Splunk searches and reports for security monitoring, operational reporting, and data analysis.

Cisco XDR Security Technologies

• Preferred hands-on experience with Cisco XDR, including integrating Cisco and third-party security products to ingest and correlate security telemetry.
• Experience performing security investigations in Cisco XDR, including reviewing detections, investigating affected assets, and using available response actions to support threat containment and remediation.
• Working knowledge of Cisco Umbrella SIG and Cisco Secure Access, including troubleshooting security policies, web access, DNS, proxy, and connectivity issues.
• Understanding of SSL/TLS inspection, including certificate-based decryption, policy exclusions, certificate trust issues, and troubleshooting encrypted traffic inspection.
• Understanding of Remote Browser Isolation (RBI) and how browser isolation can be used to reduce risk from potentially malicious or untrusted web content.
• Experience troubleshooting security integrations and validating that telemetry from Cisco and third-party security platforms is successfully flowing into the appropriate monitoring and investigation platforms.

Governance, Risk, and Compliance (GRC)

• Working knowledge of information security principles, including the Confidentiality, Integrity, and Availability (CIA) triad, and the ability to apply these principles when performing security and risk assessments.
• Experience performing information security assessments, identifying security gaps, documenting risks, and recommending appropriate controls and remediation activities.
• Working knowledge of the NIST Cybersecurity Framework (CSF) and the ability to use NIST guidance as a reference when developing, reviewing, and maintaining information security policies and standards.
• Understanding of risk management principles, including risk identification, assessment, prioritization, treatment, acceptance, and ongoing monitoring.
• Knowledge of security lifecycle management, including identifying and managing risks associated with aging technologies, end-of-life systems, unsupported software, and compensating controls.
• Familiarity with commonly used security frameworks and standards, including NIST CSF, NIST SP 800-series guidance, CIS Controls, and ISO/IEC 27001.
• Ability to translate technical security findings into business risk, including documenting impact, likelihood, remediation recommendations, compensating controls, and residual risk.
• Experience supporting risk registers, security exceptions, risk acceptance, remediation tracking, and security control assessments.

Travel

: Up to 10% travel is anticipated.