Today
Public Trust
Mid Level Career (5+ yrs experience)
$100,000 - $125,000
IT - Security
TEKsystems has an exciting opportunity for a skilled and experienced SOC Engineer to join our growing team. This individual will be responsible for engineering SOC data feed solutions, implementing SOAR capabilities, and collaborating across teams to ensure data feeds are healthy and functional. The ideal candidate will possess deep expertise in cybersecurity, including network security, security event management, incident response, and emerging threat detection technologies.
In addition to technical expertise, the candidate will serve as a SOC leadership backup, providing guidance and oversight in scenarios where the primary SOC Lead is unavailable. This includes leading team operations, managing escalations, and providing situational updates to senior leadership and stakeholders during active incidents or high-priority events.
Key Responsibilities
Microsoft Sentinel Engineering: Maintain and optimize a Microsoft Sentinel SIEM/SOAR solution in alignment with client requirements, industry best practices, and federal compliance mandates.
Data Integration: Configure and manage log/data feeds from diverse sources (e.g., Fluent Bit, Windows Events, M365, cloud services, endpoint/security platforms).
Parsing & Normalization: Develop and refine log parsing rules using Regex, DCRs, and custom transformations to ensure accurate and usable data in Sentinel.
SOAR Development: Engineer automation and orchestration solutions using Microsoft Logic Apps, Azure Functions, and PowerShell/Python scripts to improve SOC efficiency and incident response.
Threat Detection Engineering: Build, tune, and optimize analytic rules, UEBA, dashboards, and reports to improve detection and response coverage.
Collaboration: Partner with cross-functional teams (network, endpoint, cloud, IT ops) to integrate new data sources and deliver actionable SOC capabilities.
Documentation & Knowledge Transfer: Develop and maintain clear documentation of SOC architecture, log source onboarding, and automation playbooks; provide training for SOC analysts on new tools and processes.
Advisory & Improvement: Conduct gap analyses of existing SOC capabilities, recommend improvements, and contribute to SOC process maturity.
Incident Response Support: Provide Tier 3 support and assist with complex investigations when required.
Required Qualifications
U.S. Citizen with ability to obtain Public Trust clearance.
2–5 years of experience in network defense, SOC engineering, or cybersecurity operations.
Hands-on experience with Microsoft Sentinel, including log onboarding, rule development, and automation.
Proficiency with log parsing and normalization (Regex, Fluent Bit, DCRs, KQL).
Strong scripting skills in PowerShell and/or Python for automation and data handling.
Experience configuring and maintaining data feeds for SOC visibility (cloud, endpoint, network, and on-prem).
Familiarity with incident response concepts, threat detection engineering, and SOAR workflows.
Excellent written and verbal communication skills with ability to work across technical and non-technical teams.
Preferred Qualifications
Knowledge of federal cybersecurity mandates (M-21-31, NIST Cybersecurity Framework, CISA Incident/Vulnerability Playbooks, BOD 22-01).
Experience with Microsoft Logic Apps, Azure Functions, or other SOAR development platforms.
Experience with UEBA configuration to enhance anomaly detection.
Background in AI/ML frameworks for cyber analytics.
Experience building SOC metrics, dashboards, and reporting for operational visibility.
Familiarity with M365, Azure security tools, ServiceNow workflows, and CISA CDM tools.
Relevant certifications such as CISSP, CISM, Microsoft Security Operations Analyst (SC-200), or Azure Security Engineer (AZ-500).
Education & Experience
Bachelor’s degree in Computer Science, Information Security, or related field (or equivalent experience).
5+ years of progressive cybersecurity/SOC experience (engineering and operations).
Company Benefits
Eligibility requirements apply to some benefits and may depend on your job
classification and length of employment. Benefits are subject to change and may be
subject to specific elections, plan, or program terms. If eligible, the benefits
available for this temporary role may include the following:
• Medical, dental & vision
• Critical Illness, Accident, and Hospital
• 401(k) Retirement Plan – Pre-tax and Roth post-tax contributions available
• Life Insurance (Voluntary Life & AD&D for the employee and dependents)
• Short and long-term disability
• Health Spending Account (HSA)
• Transportation benefits
• Employee Assistance Program
• Time Off/Leave (PTO, Vacation or Sick Leave)
In addition to technical expertise, the candidate will serve as a SOC leadership backup, providing guidance and oversight in scenarios where the primary SOC Lead is unavailable. This includes leading team operations, managing escalations, and providing situational updates to senior leadership and stakeholders during active incidents or high-priority events.
Key Responsibilities
Microsoft Sentinel Engineering: Maintain and optimize a Microsoft Sentinel SIEM/SOAR solution in alignment with client requirements, industry best practices, and federal compliance mandates.
Data Integration: Configure and manage log/data feeds from diverse sources (e.g., Fluent Bit, Windows Events, M365, cloud services, endpoint/security platforms).
Parsing & Normalization: Develop and refine log parsing rules using Regex, DCRs, and custom transformations to ensure accurate and usable data in Sentinel.
SOAR Development: Engineer automation and orchestration solutions using Microsoft Logic Apps, Azure Functions, and PowerShell/Python scripts to improve SOC efficiency and incident response.
Threat Detection Engineering: Build, tune, and optimize analytic rules, UEBA, dashboards, and reports to improve detection and response coverage.
Collaboration: Partner with cross-functional teams (network, endpoint, cloud, IT ops) to integrate new data sources and deliver actionable SOC capabilities.
Documentation & Knowledge Transfer: Develop and maintain clear documentation of SOC architecture, log source onboarding, and automation playbooks; provide training for SOC analysts on new tools and processes.
Advisory & Improvement: Conduct gap analyses of existing SOC capabilities, recommend improvements, and contribute to SOC process maturity.
Incident Response Support: Provide Tier 3 support and assist with complex investigations when required.
Required Qualifications
U.S. Citizen with ability to obtain Public Trust clearance.
2–5 years of experience in network defense, SOC engineering, or cybersecurity operations.
Hands-on experience with Microsoft Sentinel, including log onboarding, rule development, and automation.
Proficiency with log parsing and normalization (Regex, Fluent Bit, DCRs, KQL).
Strong scripting skills in PowerShell and/or Python for automation and data handling.
Experience configuring and maintaining data feeds for SOC visibility (cloud, endpoint, network, and on-prem).
Familiarity with incident response concepts, threat detection engineering, and SOAR workflows.
Excellent written and verbal communication skills with ability to work across technical and non-technical teams.
Preferred Qualifications
Knowledge of federal cybersecurity mandates (M-21-31, NIST Cybersecurity Framework, CISA Incident/Vulnerability Playbooks, BOD 22-01).
Experience with Microsoft Logic Apps, Azure Functions, or other SOAR development platforms.
Experience with UEBA configuration to enhance anomaly detection.
Background in AI/ML frameworks for cyber analytics.
Experience building SOC metrics, dashboards, and reporting for operational visibility.
Familiarity with M365, Azure security tools, ServiceNow workflows, and CISA CDM tools.
Relevant certifications such as CISSP, CISM, Microsoft Security Operations Analyst (SC-200), or Azure Security Engineer (AZ-500).
Education & Experience
Bachelor’s degree in Computer Science, Information Security, or related field (or equivalent experience).
5+ years of progressive cybersecurity/SOC experience (engineering and operations).
Company Benefits
Eligibility requirements apply to some benefits and may depend on your job
classification and length of employment. Benefits are subject to change and may be
subject to specific elections, plan, or program terms. If eligible, the benefits
available for this temporary role may include the following:
• Medical, dental & vision
• Critical Illness, Accident, and Hospital
• 401(k) Retirement Plan – Pre-tax and Roth post-tax contributions available
• Life Insurance (Voluntary Life & AD&D for the employee and dependents)
• Short and long-term disability
• Health Spending Account (HSA)
• Transportation benefits
• Employee Assistance Program
• Time Off/Leave (PTO, Vacation or Sick Leave)
group id: 10105424
Accelerating IT transformation in the public sector
