> Markdown version of [/jobs/ext/2653100-lead-cybersecurity-engineer](https://www.wearedevelopers.com/jobs/ext/2653100-lead-cybersecurity-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Lead Cybersecurity Engineer - **Company:** K2Share LLC - **Location:** Washington, DC, United States - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Configuration Management, Cyber Security, Event Logging, Monitoring of Systems, Intrusion Detection and Prevention, Information Systems Security Engineering Professional, Zero Trust Network Access, Security Information and Event Management, Technical Data Management Systems, Data Processing, Azure Security Center, Information Technology, CIS Benchmarks, Splunk, Network Server - **Published:** August 7, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=78ab9271fe0128be ## About the Role * Bachelor's degree in computer science, engineering, cybersecurity, or a related field. Equivalent experience considered in lieu of degree. * Eight or more years in security engineering, including at least three years leading SIEM administration and detection engineering in an enterprise environment. * Demonstrated hands-on SIEM engineering depth - Splunk strongly preferred given USAC's documented use of Splunk for threat hunting- including data onboarding, field extraction, normalization, correlation search development, and content lifecycle management. * Practical engineering experience with Microsoft Defender for Endpoint and for Servers, and with a SASE or ZTNA platform; Zscaler preferred. * Demonstrated experience tuning EDR and WAF/CDN detection policy to measurable false-positive reduction. * Experience developing and maintaining security configuration baselines against CIS Benchmarks and NIST guidance, and remediating configuration drift. * Ability to produce engineering documentation and baselines that withstand audit review., * Experience integrating SIEM with SOAR and conditional access platforms. * Log management design experience aligned to OMB M-21-31 event logging maturity tiers. * Experience in a 24x7x365 SOC/NOC support model where engineering directly serves shift operations. Required Certifications CISSP, ISSEP, ITIL Foundation (latest revision), and/or an equivalent advanced security engineering or architecture certification. Platform certifications - Splunk ES Certified Admin, Microsoft SC-200 or SC-100, Zscaler ZDTA - are valuable differentiators. Applicants must be willing to take a drug test and submit to a credit and background investigation as part of the selection process. The U.S. government restricts access by Foreign Nationals to certain types of technology and technical data. Consequently, this posting is intended only for U.S. citizens. ## Description Provide technical leadership for the security engineering, SIEM, and enterprise monitoring capabilities that sustain the client's detection, alerting, and operational visibility. This position owns monitoring platform health, data source onboarding and telemetry validation, detection engineering and tuning, and the engineering baselines that keep monitoring coverage measurable and defensible., * Administer, configure, sustain, enhance, and optimize SIEM capabilities and associated monitoring functions. * Onboard and integrate new data sources; normalize and validate telemetry; expand visibility coverage and strengthen correlation logic. * Provide engineering support for log management, data handling, alert tuning, detection optimization, and operational analytics improvements. * Identify gaps in visibility, data coverage, or monitoring capability and drive corrective actions to closure. * Maintain all security tools and detections in a high-signal state through ongoing refinement in coordination with the NOC/SOC - SIEM rules, EDR alerts, and WAF/CDN policies - to reduce false positives and improve detection accuracy. * Continuously normalize and validate telemetry from existing and new data sources including Zscaler Secure Access Service Edge (SASE) and Microsoft Defender. * Support configuration management by monitoring and reporting on security control effectiveness over time, identifying and correcting configuration drift in collaboration with the NOC/SOC. * Develop and maintain monitoring procedures, technical documentation, engineering baselines, and implementation guidance. * Provide oversight of security engineering staff, monitoring architecture support, and technical improvement activities. * Support security configuration baseline development for cloud, operating system, network, and application assets against NIST and CIS benchmarks. ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Is your backend a hodgepodge of queues, event stores and cron jobs? Durable Execution to the Rescue.](https://www.wearedevelopers.com/videos/744-is-your-backend-a-hodgepodge-of-queues-event-stores-and-cron-jobs-durable-execution-to-the-rescue) - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs) - [Why Attend a Developer Event in 2026?](https://www.wearedevelopers.com/magazine/688-why-attend-a-developer-event-in-2026)