> Markdown version of [/jobs/ext/4660675-defensive-cybersecurity-engineer-soc-sme](https://www.wearedevelopers.com/jobs/ext/4660675-defensive-cybersecurity-engineer-soc-sme). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Defensive Cybersecurity Engineer/SOC SME

- **Company:** MITRE Corporation
- **Location:** McLean, VA, United States
- **Experience:** Starter
- **Salary:** $158,800 - $198,500
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Cloud Computing Security, Cyber Security, Educational Software, Network Topologies, Machine Learning, Security Information and Event Management, Reinforcement Learning, Mitre Att&ck, Deep Learning, Generative AI, Cyber Threat Analysis, Information Technology, Splunk, Security Orchestration, Automation & Response
- **Published:** November 10, 2026
- **Apply:** https://www.clearancejobs.com/jobs/9301343/defensive-cybersecurity-engineersoc-sme

## About the Role

* Typically requires a minimum of 8 years of related experience with a Bachelor's degree; or 6 years and a Master's degree; or a PhD with 3 years' experience; or equivalent combination of related education and work experience. Must have a minimum of 3 years of operational experience.

 * Bachelor's degree in Computer Science, Cybersecurity, Data Science, Applied Mathematics, Statistics, or a related field

 * Experience in leveraging common SOC tools to defend an enterprise environment.
 * Demonstrated experience conducting proactive cyber threat hunting across enterprise environments.
 * Experience developing technical training content, curriculum, courseware, or other learning materials for cybersecurity audiences.
 * Strong technical writing, presentation, and facilitation skills.
 * Ability and willingness to travel up to 25% to deliver training at customer locations, including international locations.
 * Must be eligible to obtain and maintain a Top Secret U.S Government issued Security Clearance. Per the U.S. Government's eligibility requirements, you must be a U.S Citizen to be considered for a security clearance.
 * This position requires a minimum of 3 days per week on-site., * Experience leading technical training sessions for government, partner, or other technical audiences.
 * Experience creating hands-on cybersecurity labs, exercises, or scenario-based learning materials.
 * Experience with Splunk or Elastic/ELK
 * Comfort presenting to non-English-speaking audiences with translation support.
 * Experience applying MITRE ATT&CK to support cybersecurity operations
 * Experience integrating AI-enabled workflows with cybersecurity platforms such as SIEM, SOAR, EDR/XDR, threat-intelligence, case-management, or cloud-security platforms.

## Description

* Provide subject matter expertise to government sponsors on enterprise security operations centers (SOCs), including daily operations, governance, and process improvement.
 * Translate complex defensive cybersecurity concepts into practical training tailored to sponsors' network topologies, staffing, funding, and technical resources.
 * Develop hands-on training scenarios and exercises that reflect real-world defensive cyber challenges and sponsor mission needs.
 * Apply MITRE ATT&CK® to guide threat hunting and develop defenses aligned with adversary tactics, techniques, and procedures (TTPs).
 * Design, develop, and refine security detections, analytics, and dashboards, and integrate new data sources into security information and event management (SIEM) platforms.
 * Develop, evaluate, and improve threat hunting methodologies to identify adversary activity and strengthen defensive cyber capabilities.
 * Research and evaluate emerging artificial intelligence techniques, including machine learning, deep learning, generative AI, and reinforcement learning, with an emphasis on practical, cost-effective applications to daily SOC operations.
 * Assess SOC capabilities, identify operational and technical gaps, and recommend improvements aligned with sponsor mission priorities and available resources.
 * Validate detections and defensive workflows through testing and exercises, using results to improve detection coverage, reduce false positives, and refine operational procedures.