Cybersecurity Engineer 3

Cybersecurity Engineer 3

We are seeking an experienced Cybersecurity Engineer to strengthen the agency's cybersecurity operations by developing and implementing advanced cyber defense solutions. This role is responsible for safeguarding enterprise infrastructure, supporting Splunk SIEM operations, detecting and responding to cyber threats, and ensuring security solutions are implemented according to agency standards. The ideal candidate is a highly analytical security professional with deep experience in SIEM operations, threat detection, incident response, and security monitoring.

The Cybersecurity Engineer will support VDOT's cybersecurity operations by leveraging Splunk Enterprise Security to monitor, detect, investigate, and respond to cybersecurity threats across enterprise environments. This position works closely with infrastructure, networking, and IT teams to improve detection capabilities, onboard new log sources, develop threat detection use cases, and support security compliance initiatives while protecting critical systems and data.

Responsibilities:

Threat Detection & Monitoring

• Continuously monitor network traffic, endpoint activity, cloud environments, and security logs for suspicious behavior and potential security incidents.
• Perform proactive threat hunting using Splunk Enterprise Security and advanced analytical techniques.
• Identify, analyze, and prioritize security events requiring investigation.

Splunk SIEM Administration

• Create, maintain, optimize, and tune Splunk correlation searches, dashboards, alerts, and detection rules.
• Develop efficient SPL (Splunk Processing Language) queries to improve threat detection and reduce false positives.
• Support onboarding, parsing, normalization, and validation of new log sources within the SIEM platform.

Incident Response

• Investigate security incidents and analyze forensic evidence to determine root cause and impact.
• Collaborate with infrastructure, networking, and IT teams to contain, remediate, and recover from cybersecurity events.
• Document findings and contribute to continuous improvement of incident response procedures.

Security Engineering & Threat Intelligence

• Develop and enhance detection use cases and response playbooks using threat intelligence and security frameworks such as MITRE ATT&CK.
• Support implementation of advanced cyber defense capabilities that strengthen enterprise security posture.
• Recommend improvements to monitoring, detection, and response processes.

Compliance & Reporting

• Generate security reports and SIEM metrics supporting audit readiness.
• Collect and maintain evidence required for security and compliance reviews.
• Support compliance efforts aligned with recognized security standards and internal policies.