Security Operations Engineer, Claroty

• Minimum of 2+ years of Spunk Administration experience: comfortable managing data models and CIM mapping
• Hands-on experience with Trend Micro Deep Security or Cloud One Workload Security, specifically in auto-scaling cloud environments
• Strong proficiency in AWS (GuardDuty, CloudTrail, Config)
• Ability to automate tasks using Python, Bash, or PowerShell to reduce"manual toil" in the SOC recommended
• Hands on experience with IDP (Entra ID) and managing user access and group policies. SAML/SSO federation and implementation experience
• U.S. Citizenship (required for working in GovCloud environments)

Desirable

• We are seeking a detail-oriented FedRAMP Security Operations Engineer to support our organization's adherence to the Federal Risk and Authorization Management Program (FedRAMP) requirements
• In this role, you will be the primary engineer and operator of our security monitoring stack within a FedRAMP-authorized environment
• Ideal candidates will be located in or around the DC area
• We will also consider candidates on the east coast of the US
• Ownership of our Splunk and Trend Micro environments
• Maintain standards across all daily SecOps and JIRA ticketing
• Assist with Entra ID related tasks (user access, SSO integrations, etc)
• Architect high-fidelity logging by managing Splunk data models and CIM mapping to ensure deep root-cause analysis
• Leverage scripting to automate routine tasks, allowing the team to pivot quickly from audits to active investigations
• Bridge the gap between technical complexity and business needs by explaining critical issues to non-technical stakeholders
• Support the expansion of our Public Sector practice by securing mission-critical systems and protecting national infrastructure