What are the responsibilities and job description for the Linux / SIEM Administrator position at CACI International?
Linux / SIEM Administrator
Job Category: Information Technology
Time Type: Full time
Minimum Clearance Required to Start: TS/SCI
Employee Type: Regular
Percentage of Travel Required: Up to 10%
Type of Travel: Local
CACI's Transport & Cybersecurity Services program is seeking talented Linux / SIEM Administrators to join our Cybersecurity Data Analysis team in either Springfield, VA (or) St. Louis, MO.
These positions are on CACI's Transport & Cyber Security Services (TCS) program. TCS a long-term, CACI Prime contract with the National Geospatial-Intelligence Agency (NGA) in support of the customer's GEOINT mission. More about TCS Program: https://careers.caci.com/global/en/tcs-jobs
What You'll Get to Do:
As a Linux / SIEM Administrator, you will provide cybersecurity data analysis services, which designs, develops, builds, tests, configures, employs, operates, integrates, sustains, and refreshes the Security Information Events Management (SIEM) capability (i.e. Enterprise Audit), long-term analytics platform, log aggregation platform, and the cyber threat intelligence capability, signature development and deployment, and reputation management services. This includes the onboarding of all new and existing IT resources and ensuring the correct routing of all audit events to mission partners in accordance with Intelligence Community Standards (ICS) 500-27.
More About the Role:
- Provide all preventative and corrective maintenance to ensure consistent, reliable, and secure service availability. This includes all actions required to return the service to full operational capability such as vendor RMA processes, removal and proper disposal of broken equipment/software, installation and testing of new equipment/software, and configuration of new equipment/software
- Maintain system availability and reliability with a threshold of 99.99%
- Detect and ticket degradations (volume/velocity) of all SIEM data flows within 60 minutes of the start of the degradation
- Perform day-to-day maintenance, and specific scheduled maintenance activities that result from manufacturers recommended service intervals, alerts, bulletins, available patches, and updates according to agency approved change management processes. This includes maintaining updated documentation, change logs, and service bulletin libraries for all supported equipment and software in the CSOC knowledge management platform
- Execute emergency maintenance actions with sufficient urgency to preclude unacceptable outage durations, approved by the Government prior to execution, and coordinated through and approved by CSOC and ESC government management
- Perform all development, engineering, testing, integration, and implementation actions necessary for major vendor revisions
- Perform continuous engineering assessments to improve the performance, effectiveness, coverage, and maturity of this service.
- Retain documentation regarding loss of event logs (e.g. June 5-7th DNS logs were not ingested from SBU and are lost)
- Configure all assets assigned to this service within the Government Furnished Information - Software Tools list in accordance with all Federal, DoD, IC, and NGA laws, directives, orders, polices, guidance, procedures etc.
- Perform all development, design, engineering, testing, integration, and implementation actions needed for the total integration and interoperability between all applicable assets in the Government Furnished Information - Software Tools list. This includes ensuing all data flows are properly parsed for ingestion/transmission to internal and external automated reporting systems (e.g. JFHQ DoDIN - Joint Incident Management System, DoD CIO - DoD Scorecard/Get to Green reporting, IC CIO - Cybersecurity Performance Evaluation Model reporting, etc.)
- Utilize agency approved ticketing systems to document, track, assign, update, and coordinate all engineering, integration, configuration, and maintenance actions
- Use various monitoring, analysis, and visualization tools to track effectiveness, status, performance metrics, and other information as needed or required by Government staff and contractors assigned Cybersecurity Operations Services and Cybersecurity Readiness Services
You'll Bring These Qualifications:
Clearance:
- TS/SCI clearance required (current). Must be able to successfully pass and maintain a Government Polygraph (post-hire requirement).
Education / Experience:
- Bachelors Degree and Six (6) years of job related experience. Additional experience may be considered in lieu of a degree.
Certifications:
- DoD 8570.01-M IAT Level II certification (current)
- DoD 8570.01-M CSSP Infrastructure Support certification (must be obtained within 120 days of hire date)
Skills / Knowledge:
- Linux (RHEL) Expert (administration and engineering)
- SIEM experience with one of the following: ArcSight , ElasticSearch , Splunk , Event Broker , User Behavioral Analysis (UBA)
- Providing support to Cybersecurity Operations Cell (CSOC) in creating alerting rules
- Creating SIEM playbooks
- Manipulating SIEM filters to better find and analyze potential malicious/atypical activity and reduce false positives
- Content development within ArcSight and Kibana to facilitate Cyber Analysts ability to investigate malicious events
- Creation of ArcSight rules based on use cases of malicious events
- Tuning and aggregation of queries and filters
- Troubleshooting event flow through Enterprise Audit infrastructure
- Troubleshooting event format and parsing for ingest into data storage and into SIEM tools
- SIEM and Development Projects
- SIEM support for projects and technical exchange meetings
- Developing and maintaining enterprise audit projects
These Qualifications Would Be Nice to Have
- Kibana
- Data Analytics
What We Can Offer You:
- We've been named a Best Place to Work by the Washington Post.
- Our employees value the flexibility at CACI that allows them to balance quality work and their personal lives.
- We offer competitive benefits and learning and development opportunities.
- We are mission-oriented and ever vigilant in aligning our solutions with the nation's highest priorities.
- For over 55 years, the principles of CACI's unique, character-based culture have been the driving force behind our success.
TCS2
Company Overview: At CACI, you will have the opportunity to make an immediate impact by providing information solutions and services in support of national security missions and government transformation for Intelligence, Defense, and Federal Civilian customers. CACI is an Equal Opportunity Employer - Females/Minorities/Protected Veterans/Individuals with Disabilities.
As a federal contractor, CACI is subject to any federal vaccine mandates or other customer vaccination requirements. All new hires are required to report their vaccination status.
Job Category: Information Technology
Time Type: Full time
Minimum Clearance Required to Start: TS/SCI
Employee Type: Regular
Percentage of Travel Required: Up to 10%
Type of Travel: Local
CACI's Transport & Cybersecurity Services program is seeking talented Linux / SIEM Administrators to join our Cybersecurity Data Analysis team in either Springfield, VA (or) St. Louis, MO.
These positions are on CACI's Transport & Cyber Security Services (TCS) program. TCS a long-term, CACI Prime contract with the National Geospatial-Intelligence Agency (NGA) in support of the customer's GEOINT mission. More about TCS Program: https://careers.caci.com/global/en/tcs-jobs
What You'll Get to Do:
As a Linux / SIEM Administrator, you will provide cybersecurity data analysis services, which designs, develops, builds, tests, configures, employs, operates, integrates, sustains, and refreshes the Security Information Events Management (SIEM) capability (i.e. Enterprise Audit), long-term analytics platform, log aggregation platform, and the cyber threat intelligence capability, signature development and deployment, and reputation management services. This includes the onboarding of all new and existing IT resources and ensuring the correct routing of all audit events to mission partners in accordance with Intelligence Community Standards (ICS) 500-27.
More About the Role:
- Provide all preventative and corrective maintenance to ensure consistent, reliable, and secure service availability. This includes all actions required to return the service to full operational capability such as vendor RMA processes, removal and proper disposal of broken equipment/software, installation and testing of new equipment/software, and configuration of new equipment/software
- Maintain system availability and reliability with a threshold of 99.99%
- Detect and ticket degradations (volume/velocity) of all SIEM data flows within 60 minutes of the start of the degradation
- Perform day-to-day maintenance, and specific scheduled maintenance activities that result from manufacturers recommended service intervals, alerts, bulletins, available patches, and updates according to agency approved change management processes. This includes maintaining updated documentation, change logs, and service bulletin libraries for all supported equipment and software in the CSOC knowledge management platform
- Execute emergency maintenance actions with sufficient urgency to preclude unacceptable outage durations, approved by the Government prior to execution, and coordinated through and approved by CSOC and ESC government management
- Perform all development, engineering, testing, integration, and implementation actions necessary for major vendor revisions
- Perform continuous engineering assessments to improve the performance, effectiveness, coverage, and maturity of this service.
- Retain documentation regarding loss of event logs (e.g. June 5-7th DNS logs were not ingested from SBU and are lost)
- Configure all assets assigned to this service within the Government Furnished Information - Software Tools list in accordance with all Federal, DoD, IC, and NGA laws, directives, orders, polices, guidance, procedures etc.
- Perform all development, design, engineering, testing, integration, and implementation actions needed for the total integration and interoperability between all applicable assets in the Government Furnished Information - Software Tools list. This includes ensuing all data flows are properly parsed for ingestion/transmission to internal and external automated reporting systems (e.g. JFHQ DoDIN - Joint Incident Management System, DoD CIO - DoD Scorecard/Get to Green reporting, IC CIO - Cybersecurity Performance Evaluation Model reporting, etc.)
- Utilize agency approved ticketing systems to document, track, assign, update, and coordinate all engineering, integration, configuration, and maintenance actions
- Use various monitoring, analysis, and visualization tools to track effectiveness, status, performance metrics, and other information as needed or required by Government staff and contractors assigned Cybersecurity Operations Services and Cybersecurity Readiness Services
You'll Bring These Qualifications:
Clearance:
- TS/SCI clearance required (current). Must be able to successfully pass and maintain a Government Polygraph (post-hire requirement).
Education / Experience:
- Bachelors Degree and Six (6) years of job related experience. Additional experience may be considered in lieu of a degree.
Certifications:
- DoD 8570.01-M IAT Level II certification (current)
- DoD 8570.01-M CSSP Infrastructure Support certification (must be obtained within 120 days of hire date)
Skills / Knowledge:
- Linux (RHEL) Expert (administration and engineering)
- SIEM experience with one of the following: ArcSight , ElasticSearch , Splunk , Event Broker , User Behavioral Analysis (UBA)
- Providing support to Cybersecurity Operations Cell (CSOC) in creating alerting rules
- Creating SIEM playbooks
- Manipulating SIEM filters to better find and analyze potential malicious/atypical activity and reduce false positives
- Content development within ArcSight and Kibana to facilitate Cyber Analysts ability to investigate malicious events
- Creation of ArcSight rules based on use cases of malicious events
- Tuning and aggregation of queries and filters
- Troubleshooting event flow through Enterprise Audit infrastructure
- Troubleshooting event format and parsing for ingest into data storage and into SIEM tools
- SIEM and Development Projects
- SIEM support for projects and technical exchange meetings
- Developing and maintaining enterprise audit projects
These Qualifications Would Be Nice to Have
- Kibana
- Data Analytics
What We Can Offer You:
- We've been named a Best Place to Work by the Washington Post.
- Our employees value the flexibility at CACI that allows them to balance quality work and their personal lives.
- We offer competitive benefits and learning and development opportunities.
- We are mission-oriented and ever vigilant in aligning our solutions with the nation's highest priorities.
- For over 55 years, the principles of CACI's unique, character-based culture have been the driving force behind our success.
TCS2
Company Overview: At CACI, you will have the opportunity to make an immediate impact by providing information solutions and services in support of national security missions and government transformation for Intelligence, Defense, and Federal Civilian customers. CACI is an Equal Opportunity Employer - Females/Minorities/Protected Veterans/Individuals with Disabilities.
As a federal contractor, CACI is subject to any federal vaccine mandates or other customer vaccination requirements. All new hires are required to report their vaccination status.
Linux Administrator
System One -
Chantilly, VA
Linux Administrator
BCMC -
Arlington, VA
Linux Administrator
QinetiQ US -
Chantilly, VA