Cyber Security Engineer

Telos Corporation is hiring a Cyber Security Engineer to support its deployed insider threat tools and homegrown user behavior analytics solution. The role focuses on engineering detection workflows, integrating security data sources, maintaining data pipelines, and collaborating with incident response and other teams to investigate insider risks while adhering to privacy requirements.

Responsibilities:

• Build & Tune Detections: Design, deploy, and continuously tune behavioral risk models, anomaly detection heuristics, and threat rules within our UBA platform
• Multivariate Data Analysis & Anomaly Detection: Aggregate and correlate complex, high-volume, disparate data streams (e.g., identity lifecycle, physical badge logs, security clearance details, network telemetry, OSINT, endpoint activity, and SaaS logs) to detect anomalous user behavior and construct chronological user timelines
• Reduce False Positives: Assess model performance, evaluate detection coverage against known threat matrices, and systematically minimize false-positive alert noise
• Incorporate New Signals: Partner with Corporate Engineering and Infrastructure teams to securely ingest new high-value telemetry and risk signals into the analytics engine
• Maintain Homegrown Platforms: Assist in the maintenance, optimization, and scaling of backend data pipelines, ensuring reliability and risk-scoring consistency
• Automate Response Workflows: Build API-based integrations and automated workflows to connect detection engines with investigative case management platforms and incident response ticketing
• Cross-Functional Incident Support: Work alongside Incident Response (CSIRT), Legal, HR, Privacy, and Corporate Security teams to reconstruct timelines and provide factual findings with clear confidence levels
• Strict Privacy Adherence: Execute data integration and investigative actions strictly within authorized scope, ensuring adherence to strict internal auditing, privacy regulations, and confidentiality protocols
• Technical Advisory & Tooling Integration: Serve as a technical advisor and subject matter expert for case management, insider threat software tooling setup, system administration, and engineering efforts

Requirements:

• 3+ years of experience in Security Engineering, Detection Engineering, Security Operations, or Insider Threat technical roles
• Strong proficiency in Python or Go for workflow automation, alongside solid SQL capabilities for data query and correlation
• Hands-on experience working with SIEM platforms (e.g., Splunk, Chronicle, Microsoft Sentinel), writing advanced detection queries, and configuring UBA/UEBA systems
• Good understanding of data exfiltration vectors, system logs, endpoint telemetry (EDR), and Cloud/SaaS access patterns
• The successful candidate must meet eligibility requirements to access sensitive information, which requires US citizenship
• Experience modeling "employee lifecycle" risk indicators (e.g., pre-resignation telemetry, access pattern anomalies)
• Familiarity with data engineering concepts (e.g., ETL pipelines, schema design, and log normalization)
• High degree of discretion and experience handling highly sensitive investigation logs
• Technical proficiency in implementing security engineering controls, such as Data Loss Prevention (DLP), Privileged Access Management (PAM), Zero Trust Architecture, backup tooling, and event monitoring infrastructure
• Demonstrated experience in collecting, analyzing, investigating, escalating security incidents, responding to insider incidents, and disseminating threat intelligence