Darktrace Engineer - Secret

Optiv Inc

Washington, DC, United States

1 day ago

Apply on startup.jobs

Prepare application

Role details

Contract type

Permanent contract

Employment type

Full-time (> 32 hours)

Experience level

Expert

Experience required

5 years minimum

Working hours

Regular working hours

Job source

startup.jobs

Tech stack

Microsoft Windows Active Directory Application Programming Interfaces (APIs) Artificial Intelligence Amazon Web Services Proxy Servers User Authentication Microsoft Azure Bash Shell Bioinformatics Command-Line Interface Software as a Service

+52 more

Cloud Computing Cloud Computing Security Configuration Management CompTIA Security+ Cyber Security Computer Networks System Configuration Domain Name System (DNS) Multi-Factor Authentication Intrusion Detection and Prevention Virtual Private Networks (VPN) OSI Models JSON Python (Programming Language) Network Security Linux System Administration Microsoft Security Essentials Microsoft Office Routing Network Segmentation Packet Analyzer Performance Tuning Windows PowerShell Azure Active Directory Security Information and Event Management Single Sign-On Syslog Systems Integration TCP/IP Virtual Local Area Networks Virtual Machines Virtualization Technology Data Logging Scripting Google Cloud Mitre Att&ck QRadar Cyber Threat Analysis HybridCloud Firewalls (Computer Science) Azure Security Center SC Clearance Information Technology Cybercrime Microsoft Sentinel Cortex XSOAR Platform Api Design Restful APIs Splunk Webhooks Security Orchestration, Automation & Response Servicenow

Job description

Design, deploy, configure, administer, and maintain Darktrace platform components within on-premises, hybrid-cloud, and cloud-hosted enterprise environments.
Configure and tune Darktrace detections, behavioral models, alerting thresholds, autonomous-response policies, and investigative workflows to align with the organization’s threat model, risk tolerance, architecture, and security operations processes.
Lead or support implementation of applicable Darktrace capabilities, including network, email, endpoint, cloud, SaaS, and identity-security use cases.
Perform ongoing platform health checks, capacity planning, sensor or collector placement assessments, system upgrades, configuration validation, and technical troubleshooting.
Analyze Darktrace model breaches, alerts, anomalies, incident investigations, device behavior, network traffic, and related security telemetry to identify malicious activity, suspicious behavior, false positives, and opportunities for tuning.
Collaborate with SOC analysts, incident responders, threat hunters, network engineers, cloud teams, system administrators, and identity teams to investigate and contain security events.
Develop and maintain use cases for threat detection, triage, investigation, enrichment, and escalation across enterprise security domains.
Configure, test, and maintain integrations between Darktrace and enterprise security technologies, including SIEM, SOAR, EDR/XDR, ticketing, vulnerability-management, threat-intelligence, identity, cloud-security, and log-management platforms.
Use APIs, syslog, webhooks, automation, and scripting to exchange security events, enrich detections, automate workflows, and support incident-response processes.
Support security monitoring and incident-response activities by providing deep technical analysis of network, endpoint, email, cloud, SaaS, and identity-related telemetry.
Develop standard operating procedures, implementation guides, architecture diagrams, operational runbooks, escalation procedures, and knowledge-base articles.
Produce clear technical reports and briefings that describe detected activity, risk, root cause, response actions, platform health, tuning recommendations, and security trends.
Participate in security architecture reviews and advise stakeholders on telemetry coverage, sensor placement, segmentation, visibility gaps, logging requirements, and detection strategy.
Support validation of Darktrace response actions and ensure automated or semi-automated response capabilities are appropriately governed, tested, approved, and documented before production use.
Maintain awareness of emerging threats, attacker techniques, security-tool capabilities, AI-assisted defense concepts, and relevant MITRE ATT&CK techniques.
Support compliance and audit activities by maintaining security documentation, evidence, configuration records, operating procedures, and implementation artifacts required for the environment., * Creative problem-solving and the ability to tackle unique, complex projects
Volunteer Opportunities. “Optiv Chips In” encourages employees to volunteer and engage with their teams and communities.
The ability and technology necessary to productively work remotely/from home (where applicable)

Requirements

Active Secret clearance required at time of hire.
Bachelor’s degree in cybersecurity, information technology, computer science, engineering, or a related discipline; equivalent combination of education, military training, certifications, and relevant experience may be considered.
At least 5 years of relevant cybersecurity engineering, security operations, network-security, threat-detection, incident-response, or security-platform administration experience.
At least 5 years of experience with Darktrace or comparable technologies in one or more of the following categories: Network Detection and Response (NDR), Extended Detection and Response (XDR), Endpoint Detection and Response (EDR), Network Security Monitoring (NSM), Security Information and Event Management (SIEM), User and Entity Behavior Analytics (UEBA), Security Orchestration, Automation, and Response (SOAR)
Email security, cloud security, or identity-threat detection.
Demonstrated hands-on experience deploying, configuring, tuning, administering, and troubleshooting Darktrace or similar enterprise cybersecurity platforms.
Strong knowledge of enterprise networking and network-security concepts, including TCP/IP, OSI model, DNS, DHCP, HTTP/S, SMTP, TLS, VPNs, routing, switching, VLANs, firewalls, proxies, network segmentation, and packet capture/analysis.
Experience analyzing network traffic, packet captures, security logs, endpoint telemetry, authentication events, and cloud audit data to support incident detection and investigation.
Experience with security operations processes, including alert triage, investigation, threat hunting, incident escalation, containment, evidence collection, reporting, and post-incident lessons learned.
Experience integrating security tools with SIEM and SOAR platforms, such as Microsoft Sentinel, Splunk, IBM QRadar, Elastic, ServiceNow, Microsoft Defender, Palo Alto Cortex XSOAR, or similar platforms.
Working knowledge of API-based integrations, REST APIs, JSON, webhooks, syslog, authentication methods, and log-forwarding concepts.
Experience with Linux administration and command-line troubleshooting; familiarity with virtual machines, virtualization platforms, and common enterprise operating systems.
Ability to develop basic automation or integration scripts using Python, PowerShell, Bash, or a comparable scripting language.
Strong written and verbal communication skills, including the ability to document technical designs, explain investigation findings, and brief technical and nontechnical stakeholders.
Current Darktrace certification, particularly the Darktrace Cyber Engineer Professional certification or equivalent Darktrace training.
Experience with Darktrace / NETWORK, / EMAIL, / ENDPOINT, / CLOUD, and / IDENTITY; Cyber AI Analyst investigations; Threat Visualizer; and autonomous-response capabilities and policy governance.
Experience with Microsoft security technologies, including Microsoft Defender XDR, Microsoft Defender for Endpoint, Defender for Office 365, Entra ID, Microsoft Sentinel, Azure, and Microsoft 365.
Experience with cloud-security monitoring and engineering in AWS, Azure, Azure Government, AWS GovCloud, Google Cloud Platform, or hybrid-cloud environments.
Familiarity with identity-security technologies and authentication telemetry, including Active Directory, Microsoft Entra ID, privileged access management, SSO, MFA, federation, conditional access, and identity threat detection.
Experience working in Department of Defense, intelligence community, federal civilian, defense-industrial-base, or other regulated environments.
Knowledge of NIST RMF, NIST SP 800-53, NIST SP 800-171, NIST Cybersecurity Framework, DoD STIGs, CMMC, FedRAMP, FISMA, DFARS, or other federal cybersecurity requirements.
Experience supporting classified, air-gapped, disconnected, constrained-connectivity, or highly segmented environments.
Familiarity with the MITRE ATT&CK framework, cyber threat intelligence, threat hunting methodologies, intrusion analysis, and adversary tactics, techniques, and procedures.
Relevant certifications such as CISSP, CISM, Security+, CySA+, CEH, GCIH, GCIA, GCED, CCNA, CCNP, PCNSE, AWS Security Specialty, Azure Security Engineer Associate, SC-200, SC-100, Splunk Core Certified Power User, or comparable credentials.
Strong analytical judgment and ability to distinguish normal business activity from potentially malicious or anomalous behavior.
Ability to explain AI-assisted or behavior-based detections in understandable operational and risk-based terms.
Ability to work independently while coordinating effectively across SOC, infrastructure, cloud, identity, network, and leadership stakeholders.
Strong attention to detail in configuration management, change control, evidence collection, documentation, and production implementation.
Ability to manage competing priorities, support time-sensitive incidents, and maintain disciplined escalation procedures.
Commitment to secure engineering, operational rigor, continuous improvement, and customer mission success.