Cyber Security Engineer II

Cyber Security Engineer

DPP is seeking a Cyber Security Engineer for an opportunity with our client in the healthcare insurance industry. Work location: Partial onsite (Tues., Wed., Thurs. onsite) and as needed Duration: 12 months Term: W2 position Work authorization: Candidates must be eligible to earn a low-level (Public Trust) US security clearance.

Position summary:

• Publishes and maintains an AI threat detection catalog using available telemetry data
• Deploys prioritized detection rules and performs regular tuning on a set schedule
• Reduces repeat false positive alerts through tuning and adjustment of detection logic
• Improves alert triage and escalation times for AI-related security events
• Uses enrichment to support more efficient alert review and handling
• Establishes baseline monitoring for approved AI tools
• Sets and monitors thresholds to identify abnormal AI tool usage
• Tracks and identifies risky AI usage patterns
• Supports remediation of identified AI-related risks
• Produces recurring reports on AI usage and associated risks
• Develops and documents AI-focused incident response runbooks
• Participates in tabletop exercises to test and validate response procedures
• Updates runbooks and detection rules based on lessons learned from exercises
• Works with cross-functional teams including leadership, architects, and senior technical staff
• Communicates findings and updates clearly to both technical and non-technical audiences

Required experience:

• Experience working with security operations, detection engineering, or incident response processes
• Hands-on experience using SIEM and SOAR tools for monitoring and response workflows
• Ability to develop or use automation and scripting (e.g., Python, KQL, SPL) to support security operations
• Working knowledge of common AI/ML security risks such as prompt injection, data leakage, and over-reliance on AI outputs

Nice to have:

• Previous experience working in a Security Operations Center (SOC) environment
• Industry certifications related to artificial intelligence or machine learning

About the team:

• Small CSOC team (about 13 people) split between analysts and engineers, working closely together on day-to-day security operations.
• Currently focused on integrating a new SIEM and rolling out AI-related security capabilities across the environment.
• Hours: 8AM – 5PM – M-F. Possible, but likely rare: overtime, travel, weekends, off hours.

Minimum required work experience:

• 6 years of job-related technical experience.

Required education/equivalencies:

• Bachelor's degree in Computer Science, Information Technology, or other job-related degree;
• OR, Associates degree in CS, IT, or other job-related degree plus 2 years of work-related experience;
• OR, 4 years job-related work experience (total 10 years without a degree)