Job Description

Salary: $72,000 - 112,000 per year Requirements:

• 5+ years of experience in IT or security, including at least 3 years engineering or administering security platforms such as EDR, SIEM, XDR, SOAR, firewalls, IPS, web proxies, or email security tools.
• Experience administering DNS-layer and email security platforms such as Cisco Umbrella, DNSFilter, and Avanan.
• Solid networking fundamentals, including TCP/IP, routing, switching, VLANs, DNS, DHCP, and proxy concepts.
• Working knowledge of Windows Server, Active Directory, Entra ID, Microsoft 365, and Linux administration.
• Ability to script with PowerShell and/or Python and work with REST APIs.
• Experience managing change, testing, and documentation for production security systems.
• Ability to assess control environments, identify gaps, and make clear recommendations that address priority, effort, and business impact.
• Clear communication with analysts, managers, and client IT teams, including written change notices and post-change summaries.
• Relevant certifications such as CompTIA Security+, CySA+, or Cisco CCNA, or equivalent experience.
• Preferred: A bachelors degree in Cybersecurity, Information Technology, Computer Science, or a related field; equivalent military training or certifications may also be considered.
• Preferred: MSP or MSSP experience in a multi-tenant environment, including use of a multi-tenant PSA or ticketing platform such as ConnectWise, Autotask, or ServiceNow.
• Preferred: Multi-site and multi-tenant deployment experience, including managing agents and policies across multiple client consoles or parent-and-child tenant structures.
• Preferred: Vendor certifications such as Splunk Core Certified Power User or Admin, CrowdStrike CCFA, SentinelOne platform certifications, or Cisco CCNP Security.
• Preferred: Advanced security certifications such as GIAC GSEC, GCIA, or GCDA, or CISSP.
• Preferred: Detection engineering experience with SPL, Sigma rules, KQL, or SentinelOne query syntax.
• Preferred: SOAR or rules-based automation experience, including operationalizing playbooks alongside an AI Automation Engineer.
• Preferred: Familiarity with other tools in our environment, including Blumira, Velociraptor, ConnectSecure, and NodeZero.
• Preferred: Configuration management or infrastructure-as-code experience with Ansible, Terraform, or similar tools.
• Preferred: Experience aligning security controls with frameworks such as CIS Controls, NIST CSF, SOC 2, HIPAA, or CMMC.

• Own administration and health of our SOC security stack, including SentinelOne, CrowdStrike, Splunk, Cisco Firepower and ASA, Cisco Umbrella, DNSFilter, Avanan, and our security awareness training platform.
• Plan and deliver platform updates, agent upgrades, policy changes, and version lifecycles across client tenants, following change control, testing, maintenance windows, and rollback planning.
• Deploy and onboard security tools for new clients, including agent rollouts, log source integrations, policy baselines, and handoff documentation for the SOC.
• Onboard log sources, maintain parsing and field extractions, monitor for stalled or missing sources, and manage license and storage usage.
• Build, tune, and maintain detections and correlation searches with SOC analysts, reducing false positives and addressing coverage gaps mapped to MITRE ATT&CK.
• Maintain perimeter and DNS security by reviewing Cisco Firepower and ASA rule sets, IPS policies, and VPN configurations, and managing Cisco Umbrella and DNSFilter policies across tenants.
• Support phishing simulations and training campaigns using our security awareness platform.
• Identify people, process, and technology gaps; review agent deployment, log sources, and policy drift; benchmark against CIS Controls and NIST CSF; and present prioritized recommendations to the Security Operations Manager.
• Evaluate tools and features by running proofs of concept, comparing vendors, managing vendor support cases, and preparing business cases that weigh risk reduction, operational effort, and cost.
• Automate repetitive tasks with PowerShell, Python, and platform APIs, and partner with our AI Automation Engineer on SOAR playbooks and integrations.
• Support analysts during incidents with containment actions, emergency blocks, and tooling troubleshooting, and participate in the after-hours escalation rotation.
• Keep engineering documentation current, including architecture diagrams, configuration standards, tool runbooks, and client-specific deployment notes.

• AI
• Active Directory
• Ansible
• Cisco
• Support
• Linux
• Microsoft 365
• PowerShell
• Python
• REST
• Security
• ServiceNow
• Splunk
• TCP/IP
• Terraform
• VPN
• Web
• Windows
• Office 365

More:

At EXOS, our Cybersecurity Engineer maintains and improves the security stack that supports our SOC across client environments. This hands-on engineering role reports to the Security Operations Manager and serves as an engineering escalation point for Cybersecurity Analysts I, II, and III. The work focuses on keeping a multi-tenant security environment reliable and effective at scale.

last updated 43 week of 2026

Job Tags

Similar Jobs