Senior Security Engineer - Crowdstrike

UltraViolet Cyber is seeking a Senior Security Tools Engineer to support the security tools environment on the Security Tools program.

This is a hybrid role based in Oxon Hill, MD, with three days per week onsite.

The Senior Security Tools Engineer should feel comfortable not only diagnosing cross-tool problems but assisting with escalations and onsite tasks as they arise.

Responsibilities:

• Lead cross-tool security engineering efforts, advising on best practices for closing detection and reporting gaps that span multiple platforms
• Diagnose and resolve reporting and visibility gaps created when a tool in the environment is deprecated, replaced, or reconfigured
• Design, implement, and document data flows and integration points across endpoint protection, SIEM, and other security tools supporting the program
• Build and tune detection logic, correlation searches, and dashboards that hold up as individual tools in the stack change, are replaced, or are retired
• Lead the technical transition work when a security tool is deprecated, replaced, or reconfigured, ensuring no loss of detection or reporting coverage
• Integrate tools such as CrowdStrike, Splunk, Cribl, CyberArk, Suricata, Tenable, Tanium, Thales, CASB, Trellix, Axonius, and others to close cross-platform visibility gaps
• Develop automation and correlation workflows using APIs across the security tool stack to reduce manual reporting and analysis work
• Support threat hunting and incident response efforts that require correlating evidence across more than one tool or data source
• Support endpoint and platform security compliance with NIST, FISMA, and agency-specific requirements
• Maintain current, accurate documentation of tool configurations, data flows, and integration architecture across the stack
• Serve as the team's point of contact for cross-tool security engineering issues

Requirements:

• Ability to attain DHS EOD
• Master's degree or equivalent, plus 12 years of relevant experience
• Demonstrated, hands-on experience across more than one security tool category (endpoint/EDR, SIEM, vulnerability management, network detection, or similar)
• Hands-on experience with an EDR/endpoint platform (e.g., CrowdStrike Falcon) , administration, detection engineering, or response
• Hands-on experience with Splunk (or an equivalent SIEM) , search, correlation searches, and dashboard/reporting development
• Demonstrated experience correlating and integrating data across disparate security platforms to close a visibility, detection, or reporting gap
• Scripting/automation proficiency (Python, PowerShell, or similar) for cross-tool data pipelines and API integrations
• Experience owning a tool deprecation or migration without losing detection or reporting coverage
• Effective communicator at all levels, both written and verbal
• Professional, customer-oriented, and even-keeled under pressure

Benefits:

• 401(k), including an employer match of 100% of the first 3% contributed and 50% of the next 2% contributed
• Medical, Dental, and Vision Insurance (available on the 1st day of the month following your first day of employment)
• Group Term Life, Short-Term Disability, Long-Term Disability
• Voluntary Life, Hospital Indemnity, Accident, and/or Critical Illness
• Participation in the Discretionary Time Off (DTO) Program
• 11 Paid Holidays Annually