Cyber Engineer Principal

SAIC is hiring a Principal Cyber Engineer to provide hands-on cyber engineering expertise across customer environments. The role assesses and matures cyber programs, engineers security architectures and automation, supports emerging areas such as Zero Trust and AI security, and teaches teams while contributing technical artifacts and proposal content.

Responsibilities:

• Enter customer spaces on short cycle. Learn the stack and the people in days. Leave usable artifacts, not just a briefing deck
• If the space is new, thin, or stuck, drive the cyber team, then hand it back runnable. Consult contract cyber leads; do not replace them
• Assess cyber programs and customer environments against applicable cyber and security frameworks. Recommend solutions, modernization, automation, and next steps to mature the innovation space
• Work in Zero Trust, AI platform security, data engineering for security telemetry, and SIEM / SOC architecture and automation. Support growing efforts in AI governance and securing AI agents and tool gateways
• Apply RMF, CMMC, and ICD-705 in live spaces. Support incident response. Engineer and tune security and cloud architecture, endpoint platforms, DLP, IPS, and load-balancer / traffic paths
• Treat time-indexed data (what happened) and stateful data (what is true now) as complementary, and use platforms and vendor relationships so both exist and feed Zero Trust activity targets
• Troubleshoot with CLI first—Windows, Linux, security-tool CLIs, AWS Console and AWS CLI. Escalate with evidence
• Teach. Present white papers. Write job aids for new and old frameworks. Contribute technically to proposals

Requirements:

• Bachelor's degree and 9 years of experience, or A Master's degree and 7 years of experience
• U.S. citizen with an active Top Secret clearance and the ability to obtain SCI
• Current CompTIA Security+ CE or equivalent 8140 intermediate certification
• Typically 8+ years of hands-on cyber engineering, SOC / SIEM architecture, enablement, or equivalent at Senior Principal depth
• Must be able to drive a team and advise a contract cyber lead
• Experience assessing cyber programs and environments against cyber and security frameworks, then recommending solutions, modernization, and automation
• Proven work in customer spaces, including mixed classification, on a support-request cadence
• Technical depth in Zero Trust and AI platforms; data engineering applied to security telemetry; SIEM automation or SOC tooling and architecture
• Working familiarity within RMF, CMMC, ICD-705, incident response, security architecture, cloud security architecture, endpoint security platforms, DLP, IPS, and load balancers
• Can clearly explain time-indexed vs. stateful data, why a security environment needs both, and how tooling and vendors provide both for Zero Trust activity targets
• Strong troubleshooting skills
• Current CLI on Windows and Linux (PowerShell, Bash or equivalent)
• Hands-on AWS Console and AWS CLI (IAM, CloudTrail, GuardDuty, Security Hub, VPC / flow logs, S3, CloudWatch or equivalent)
• Communicates and teaches cleanly
• Writes job aids and presents to mixed audiences (technical and non-technical)
• Splunk experience strongly preferred
• Current SCI
• Splunk Certified Admin, higher, or equivelant for security data engineering knowledge and experience yet not biased to any one tool. (Splunk, elastic, sentinal, etc…)
• CISSP or higher (ISSAP, ISSEP, or ISSMP) to cover GRC related assignments
• Additional current credentials in cloud, detection, architecture, or data (CCSP, CISM, GIAC, AWS / Azure security, CySA+ / CASP+, or equivalent)
• Proposal / capture technical consulting; published or internal white papers; prior enablement of mixed-skill cyber teams
• Budding interest in AI governance and in securing AI agents and tool gateways
• Experience with SOAR, EDR / XDR, identity platforms, security data lakes, and securing AI / ML platforms (Azure OpenAI, Bedrock, on-prem model hosting, RAG / LLMOps controls)