SOC Engineer

Purpose and Impact: (a write up about the program that will attract candidates) Come be part of a dynamic program that delivers enterprise infrastructure, systems engineering, and operational support across multiple mission-critical network environments. Our team designs, implements, and sustains modern technology solutions supporting real-world customer operations. We foster a highly collaborative and technical culture that values innovation, continuous learning, and professional growth. Team members are encouraged to expand their expertise through training opportunities, cross-functional collaboration, and hands-on experience with a wide range of technologies supporting complex operational environments. Work Schedule: (shift hours and days of the week) 8hrs / day, 5 days per week, all onsite Occasional after hours work for system maintenance Essential Responsibilities: (describe the day-to-day) We are seeking a highly motivated SOC Engineer to support the design, deployment, and continual improvement of enterprise Security Operations Center (SOC) capabilities. The successful candidate will serve as a key technical contributor responsible for SIEM engineering, log management architecture, threat detection development, security automation, and incident response support within classified environments. This is a hands-on-keyboard position requiring expertise in deploying and maintaining security monitoring platforms, developing advanced detection capabilities, and improving the overall effectiveness of cyber defense operations. The SOC Engineer will work closely with cybersecurity analysts, incident responders, system administrators, network engineers, and customer stakeholders to enhance security visibility and defend critical mission systems against evolving threats. Key Responsibilities include: Design, implement, configure, and maintain SIEM, log management, and security monitoring solutions supporting enterprise cybersecurity operations. Evaluate existing SOC architectures and recommend improvements to increase operational effectiveness, scalability, and threat visibility. Engineer and optimize log collection pipelines to ensure comprehensive security event coverage across network, system, application, and cloud environments. Develop, test, tune, and maintain detection content, including correlation searches, threat detections, alerts, signatures, and analytics. Identify gaps in detection coverage and implement solutions aligned with current threat intelligence and adversary techniques. Create and maintain SOC playbooks, standard operating procedures, and incident response workflows. Support security incident investigations through log analysis, endpoint analysis, malware analysis, and forensic data collection. Design and implement security automation and orchestration capabilities to reduce analyst workload and improve response times. Develop metrics, dashboards, and reporting capabilities to measure SOC performance, alert fidelity, detection effectiveness, and operational health. Participate in threat hunting activities to identify stealthy or previously undetected malicious activity. Support malware analysis efforts, including static and dynamic analysis techniques and reverse engineering activities when required. Author scripts and automation tools using languages such as Python, PowerShell, or Bash to improve SOC efficiency and detection capabilities. Document technical architectures, operational procedures, engineering designs, and implementation plans. Provide technical recommendations regarding emerging security technologies, tools, and best practices. Collaborate with customer stakeholders to understand mission requirements and translate those requirements into technical solutions. Work Environment, Physical Demands, and Mental Demands: Standard working environment Minimum Requirements (Knowledge, Skills, and Abilities): 6+ years of experience supporting Security Operations Centers (SOC), cybersecurity engineering, SIEM engineering, or Information System Security Engineering (ISSE). Experience deploying, administering, and maintaining Splunk Enterprise Security and/or other enterprise SIEM platforms. Strong understanding of security event management, log management, and threat detection methodologies. Experience developing SIEM correlation searches, analytic rules, dashboards, and detection use cases. Experience supporting cybersecurity operations within classified or highly regulated environments. Strong knowledge of Windows and Linux operating systems, including system administration and troubleshooting. Experience with scripting or automation using PowerShell, Python, Bash, or similar languages. Experience working within virtualized and containerized environments. Understanding of common attack frameworks such as MITRE ATT&CK and cyber kill chain methodologies. Knowledge of incident response, digital forensics, threat hunting, and malware analysis principles. Experience producing technical documentation, architecture diagrams, implementation plans, and engineering reports. Strong communication and customer engagement skills with the ability to explain technical concepts to both technical and non-technical stakeholders. Security Clearance Required: TS / SCI Minimum Education: High School Diploma or equivalent Preferred Bachelor's Degree in Information Technology, Computer Science, Engineering, or related field undefinedMinimum Years of Experience:6+Required Certifications:This is an IAT3 level billet. Applicant must have:- Required IAT Certs: one or more of the following: CISM, CISSP, or equivalent senior-level baseline certification- Required vendor certification in one or more relevant technologies (e.g., Microsoft, VMware, Cisco, NetApp, Pure Storage, HP, Dell, Linux+, Red Hat, HBSS, ACAS). Candidates without an active certification must obtain at least one within 6 months of hire Preferred Qualifications: AI if applicable to your programExperience with Splunk Enterprise Security, Security Onion, Corelight, Zeek, Suricata, Elastic, or similar cybersecurity platforms.Experience with Logstash, Docker, Podman, and containerized application deployments.Experience integrating threat intelligence feeds into SIEM and detection platforms.Familiarity with SOAR technologies and security automation frameworks.Experience performing malware analysis, reverse engineering, or digital forensics.Experience supporting DoD, Intelligence Community, or classified enterprise networks.Experience with Red Hat Enterprise Linux administration.Familiarity with cloud security platforms including AWS, Azure, or Google Cloud.Experience with NIST RMF, NIST 800-53, STIGs, CIS Benchmarks, or equivalent compliance frameworks.Experience with VMware, Hyper-V, Nutanix, or other enterprise virtualization platforms.Experience with enterprise backup, disaster recovery, and business continuity solutions.Prior Security Operations Center experienceExperience with Zero Trust architecturesPrior Military experienceAdditional Hashtags:#javelinThis position [is not] designated as a safety sensitive position.As part of our commitment to maintaining a safe and compliant work environment, Amentum is a drug-free workplace and requires all personnel to comply with company drug and alcohol policies as a condition of employment. Employment is contingent upon successful completion of the drug screening process. Please note that this may include pre-hire screening for marijuana, as well as other federally controlled substances due to Amentum’s role as a federal contractor and trusted partner to the US Government. Other Responsibilities:Safety - Amentum enforces a safety culture whereby all employees have the responsibility for continuously developing and maintaining a safe work environment. As appropriate, each employee is responsible for completing all training requirements and fulfilling all self-aid/buddy aid responsibilities, participating in emergency response tasks and serving on safety committees and teams.Quality - Quality is the foundation for the management of our business and the keystone to our goal of customer satisfaction. It is our policy to consistently provide services that meet customer expectations. Accordingly, each employee must conform to the Amentum Quality Policy and carry out job activities in compliance with applicable Amentum Quality System documents and customer contracts. Each employee must read and understand his/her Quality Management and Customer Satisfaction responsibilities.Procedure Compliance - Each employee must read, understand and implement the general and specific operational, safety, quality and environmental requirements of all plans, procedures and policies pertaining to his/her job. Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, sexual orientation, gender identity, disability or protected veteran status. Compensation Details: $140,000 - $190,000 The compensation range or hourly rate listed for this position is provided as a good-faith estimate of what the company intends to offer for this role at the time this posting was issued. Actual compensation may vary based on factors such as job responsibilities, education, experience, skills, internal equity, market data, applicable collective bargaining agreements, and relevant laws. Benefits Overview: Our health and welfare benefits are designed to support you and your priorities. Offerings include: Health, dental, and vision insurance Paid time off and holidays Retirement benefits (including 401(k) matching) Educational reimbursement Parental leave Employee stock purchase plan Tax-saving options Disability and life insurance Pet insurance Note: Benefits may vary based on employment type, location, and applicable agreements. Positions governed by a Collective Bargaining Agreement (CBA), the McNamara-O'Hara Service Contract Act (SCA), or other employment contracts may include different provisions/benefits. Original Posting: 10/12/2026 - Until Filled Amentum anticipates this job requisition will remain open for at least three days, with a closing date no earlier than three days after the original posting. This timeline may change based on business needs. Amentum is proud to be an Equal Opportunity Employer. Our hiring practices provide equal opportunity for employment without regard to race, sex, sexual orientation, pregnancy (including pregnancy, childbirth, breastfeeding, or medical conditions related to pregnancy, childbirth, or breastfeeding), age, ancestry, United States military or veteran status, color, religion, creed, marital or domestic partner status, medical condition, genetic information, national origin, citizenship status, low-income status, or mental or physical disability so long as the essential functions of the job can be performed with or without reasonable accommodation, or any other protected category under federal, state, or local law. Learn more about your rights under Federal laws and supplemental language at Labor Laws Posters. Welcome back! We encourage you to check on the status of your current job applications with us. You can also search for a list of our current job openings and see if there are any new positions that might be a good fit for you. Thank you for continued interest in employment with Amentum. For more than 100 years, Amentum has tackled the world’s toughest challenges to deliver agile and steadfast solutions to the U.S. government and its allies. With more than 50,000 employees on all seven continents and in more than 60 countries, Amentum delivers a broad range of operational support services to meet the critical needs of our clients. Our headquarters are in Chantilly, VA. Find us online at https://www.amentum.com/ If you need a reasonable accommodation for any part of the employment process, please complete our Accommodation Request. Requests for accommodation will be considered on a case-by-case basis. If you need assistance, please reach out to workdaycandidateaccounts@amentum.com EEO including Disability/Protected Veterans Labor Laws Posters Amentum has become aware of unauthorized individuals who are falsely using the Amentum name and /or logo in an attempt to solicit fees from potential job seekers. These deceptive and unauthorized individuals are soliciting money, promising placement in a position with Amentum. Please note any communication requesting any amount of money in exchange for employment with Amentum is fraudulent. These communications do not originate from Amentum and are not associated with the recruitment process. Amentum and its affiliates never charge candidates fees or payments of any kind in order to secure employment. As a precaution, we recommend you do not disclose personal or financial details to anyone as a response to an unsolicited email, social media, or dating website request. Amentum will never as ask for a placement fee or any other fee to expedite the hiring process. If you are contacted by anyone offering employment with Amentum, you should never be asked to pay a fee for recruiting. Amentum personnel will always send email from an identifiable corporate account (ending in @amentum.com) and never from a public email account like Yahoo!, Google, Gmail, or Hotmail. If you are contacted regarding a fraudulent employment proposal, we encourage you to alert your local law enforcement agency/police authority. To read more about Amentum’s commitment to ethics, please click here.