SOC Security Engineering Technician - Journeyman

Position Summary ECS is seeking a SOC Security Engineering Technician – Journeyman to support the Army National Guard (ARNG) Enterprise Network Operations and Cybersecurity Support (ENOCS) program. This position supports Task 3 — Cybersecurity Operations Support — by leading implementation, configuration, and sustainment of security engineering solutions that enable Security Operations Center (SOC) monitoring, detection, and response across ARNG enterprise environments. The role integrates with the broader ENOCS cyber team by coordinating with SOC analysts, CTIC, CDAP, and infrastructure stakeholders to maintain continuous monitoring, improve event correlation, and preserve monitoring coverage and alert fidelity in support of Defensive Cyberspace Operations – Internal Defensive Measures (DCO‑IDM). This role directly contributes to ARNG’s mission to defend classified and unclassified network environments supporting more than 120,000 users and approximately 141,000 endpoints across roughly 2,800 sites in 54 states and territories. Responsibilities Lead implementation, configuration, and maintenance of security engineering capabilities that support SOC monitoring, detection, and response operations across ARNG enterprise environments. Integrate and sustain security tools, sensors, log forwarding mechanisms, and telemetry pipelines to improve monitoring coverage, event quality, and alert fidelity. Support continuous monitoring operations by validating data flow and correlation effectiveness within the ARNG cyber environment, including USIEM‑integrated analytics and related detection engineering activities. Troubleshoot security engineering issues affecting visibility, sensor performance, log ingestion, and monitoring effectiveness across classified and unclassified enclaves. Perform system hardening support and validate configuration baselines to help maintain secure operational conditions aligned with DoD and ARNG cybersecurity policy. Document configuration changes, remediation actions, and engineering updates to support traceability, operational continuity, and RMF‑related evidence requirements. Coordinate with SOC, CTIC, CDAP, and infrastructure teams to sustain enterprise monitoring capabilities and support threat detection, vulnerability management, and cyber defense operations. Support cybersecurity engineering activities performed in coordination with the NETCOM Global Cyber Center and DISA DCDC to maintain defensive coverage across the DoDIN‑Army‑NG area of responsibility. Assist with maintaining monitoring and response capabilities that support ARNG missions across 54 states and territories, including operational environments tied to Title 10, Title 32, and SIPRNet‑supported activities. Required Qualifications U.S. Citizenship is required. Security Clearance: TS/SCI Eligible. Required Certifications: DCWF Work Role 521‑Cyber Defense Infrastructure Support Specialist – Intermediate proficiency; must hold one or more of the following: GMON, GRID, CEH, Cloud+, CySA+, GSEC, PenTest+, Security+, SSCP. Experience: 7+ years of experience in cybersecurity. Education: Bachelor’s degree or higher in Computer Science, Cybersecurity, Data Science, Information Systems, Information Technology, or Software Engineering. Experience implementing, configuring, and sustaining security engineering solutions that support SOC monitoring, detection, and response operations. Experience integrating security sensors, log forwarding mechanisms, and telemetry pipelines to enable comprehensive visibility and accurate event correlation. Experience supporting system hardening activities, validating configuration baselines, and assisting with remediation of monitoring or security control deficiencies. Experience documenting configuration changes, remediation actions, and technical updates in support of operational accountability and auditability. Experience coordinating with cross‑functional cybersecurity and infrastructure teams to maintain continuous monitoring capabilities. Experience supporting RMF‑aligned cybersecurity operations and compliance activities within classified and unclassified enterprise environments. Experience supporting enterprise cybersecurity operations at scale across distributed users, endpoints, or sites. Desired Qualifications Active TS/SCI Security Clearance (preferred). Experience supporting USIEM‑related data integration, analytics enablement, or detection engineering in a SOC environment. Experience working with EDR, IDS/IPS, or related security monitoring technologies in support of continuous cyber defense operations. Experience supporting ARNG, Army, or other DoD enterprise cybersecurity environments with coordination across organizations such as NETCOM, RCCs, or DISA. Experience supporting cybersecurity operations for SIPRNet or other classified environments in addition to unclassified enterprise enclaves. Familiarity with MITRE ATT&CK‑informed detection use cases, threat‑informed defense, and operational handoff practices supporting 24/7 cybersecurity monitoring. Equal Opportunity Employer Statement ECS Federal LLC is an equal opportunity employer and does not discriminate or allow discrimination on the basis of any characteristic protected by law. All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran, or any other status protected by applicable federal, state, or local jurisdiction law. #J-18808-Ljbffr ECS