SIEM Engineer

Location: Fort Belvoir, VA

Department: 60024449 - AFS Cyber Resilience and Defense

The SIEM engineer is responsible for monitoring and analyzing security events using the program’s Security Information and Event Management (SIEM) systems. This role reviews security logs, identifies potential security incidents, and escalates events for further investigation. The SIEM Analyst tunes SIEM rules and alerts to improve detection accuracy and generates security reports to support operational awareness. The position collaborates with IT and security teams to respond to incidents, implement corrective actions, support policy development, and contribute to continuous improvement initiatives that strengthen the program’s security posture.

The Work:

• Monitor and analyze security events and logs using SIEM platforms.
• Identify potential security incidents and escalate them to the appropriate teams for investigation.
• Tune SIEM rules, alerts, and correlation logic to enhance threat detection accuracy.
• Generate routine and ad‑hoc security reports to support situational awareness.
• Collaborate with IT and security teams to respond to incidents and implement corrective actions.
• Assist in the development and maintenance of security policies, procedures, and documentation.
• Participate in initiatives to improve SIEM capabilities and overall security posture.
• Stay updated on emerging threats, SIEM best practices, and detection techniques.
• Ensure accurate documentation of findings and maintain detailed event records.

Qualifications:

• U.S Citizen
• Bachelor’s degree in IT, Computer Science, Cybersecurity, or a related field; or 4 years additional equivalent work experience.
• 10 years of experience with cybersecurity
• Strong understanding of cybersecurity principles and SIEM platform fundamentals.
• Familiarity with tuning SIEM rules and alerts, as well as generating SIEM‑based reports.
• Must maintain DOD 8140 compliance for IAT 2

Preferred Qualifications

• Certifications such as CompTIA Security+, CEH, or relevant SIEM platform certifications.
• Experience working with SOC teams, incident response workflows, or enterprise SIEM technologies.
• Excellent analytical and problem‑solving skills with the ability to assess logs and identify suspicious activity.

Security Clearance:

• An active TS/SCI federal security clearance is required