Security Engineer

Capgemini Government Solutions supports aerospace and federal government clients with business and technology transformation services. The Security Engineer – Operational Support will support enterprise cybersecurity operations by monitoring security technologies, responding to incidents, managing operational requests, and engineering and optimizing security platforms and infrastructure.

Responsibilities:

• Monitor, maintain, and support enterprise security technologies, including SIEM, IDS/IPS, vulnerability management, and malware protection solutions
• Respond to security incidents, alerts, and operational events in accordance with established procedures
• Triage and manage requests from service management queues and engineering support mailboxes
• Configure, tune, and optimize security tools, policies, detections, and alerts
• Troubleshoot security infrastructure and support audit, compliance, and governance activities
• Support ITSM processes including incident, problem, and change management
• Analyze network traffic, authentication events, endpoint telemetry, and other security data to identify threats
• Develop and maintain security documentation, standards, procedures, and playbooks
• Collaborate with cross-functional teams to improve security posture and operational effectiveness

Requirements:

• U.S. Citizenship required
• Ability to obtain and maintain a DoD Secret Security Clearance
• 5+ years of experience in a Security Operations Center (SOC) or Security Engineering environment
• Experience supporting large enterprise cybersecurity operations
• Strong understanding of TCP/IP networking, security monitoring, and incident response methodologies
• Knowledge of security frameworks including NIST, ISO 27001, CMMC, SOX, and PCI-DSS
• Strong written and verbal communication skills
• Applicants for employment in the US must have valid work authorization that does not now and/or will not in the future require sponsorship of a visa for employment authorization in the US by Capgemini
• Experience with Microsoft Sentinel, Splunk, QRadar, ArcSight, or similar SIEM platforms
• Experience with Microsoft Defender, CrowdStrike, Trellix, or similar endpoint security technologies
• Experience with vulnerability management tools such as Tenable, Nessus, Qualys, or Rapid7
• Knowledge of cloud security, particularly Microsoft Azure
• Experience with PowerShell, Python, KQL, APIs, automation, and SOAR technologies
• Experience supporting Linux/Unix environments
• Industry certifications such as CISSP, CCSP, CISA, GCIH, GCIA, GCFA, GPEN, or equivalent