Cybersecurity Engineer Principal

GDIT

HybridPosted July 27, 2026

About the role

Cybersecurity Engineer Principal at GDIT. This senior technical role leads the design, implementation, optimization, and automation of the SIEM/SOAR/EDR ecosystems and serves as the subject matter expert for Windows and Linux systems, vulnerability management, and related security platforms. You will work at the intersection of systems engineering, security operations, data engineering, and platform architecture to build telemetry pipelines and detection logic powering Tier I–III analyst workflows.

Cybersecurity Engineer Principal

GDIT

HybridPosted July 27, 2026

About the role

Cybersecurity Engineer Principal at GDIT. This senior technical role leads the design, implementation, optimization, and automation of the SIEM/SOAR/EDR ecosystems and serves as the subject matter expert for Windows and Linux systems, vulnerability management, and related security platforms. You will work at the intersection of systems engineering, security operations, data engineering, and platform architecture to build telemetry pipelines and detection logic powering Tier I–III analyst workflows.

Responsibilities

Administer, harden, and automate Windows Server and Linux systems (Red Hat, Rocky, Ubuntu, Amazon Linux); manage Active Directory, IAM, and PKI; apply secure configurations and patch baselines; develop automation tooling using PowerShell and Bash.
Design, implement, and operate distributed SIEM architectures; onboard and normalize data sources; develop parsing logic and normalization; manage ingestion pipelines.
Develop high-fidelity SIEM detections, dashboards, alerts, and reporting; implement retention strategies; integrate components via REST APIs and SDKs; ensure observability and automation validation.
Build and maintain SOAR workflows; script in Python and PowerShell/Bash; integrate ticketing, identity platforms, and threat intel; monitor automation KPIs.
Administer and optimize EDR platforms (e.g., CrowdStrike Falcon; Defender for Endpoint or SentinelOne); tune policies; develop detections mapped to MITRE ATT&CK; integrate telemetry into SIEM pipelines; support incident response.
Operate vulnerability and compliance programs (Qualys/Tenable/

Responsibilities

Administer, harden, and automate Windows Server and Linux systems (Red Hat, Rocky, Ubuntu, Amazon Linux); manage Active Directory, IAM, and PKI; apply secure configurations and patch baselines; develop automation tooling using PowerShell and Bash.
Design, implement, and operate distributed SIEM architectures; onboard and normalize data sources; develop parsing logic and normalization; manage ingestion pipelines.
Develop high-fidelity SIEM detections, dashboards, alerts, and reporting; implement retention strategies; integrate components via REST APIs and SDKs; ensure observability and automation validation.
Build and maintain SOAR workflows; script in Python and PowerShell/Bash; integrate ticketing, identity platforms, and threat intel; monitor automation KPIs.
Administer and optimize EDR platforms (e.g., CrowdStrike Falcon; Defender for Endpoint or SentinelOne); tune policies; develop detections mapped to MITRE ATT&CK; integrate telemetry into SIEM pipelines; support incident response.
Operate vulnerability and compliance programs (Qualys/Tenable/

Track similar jobs

Get email alerts when new roles like this are posted.

Based on: Cybersecurity Engineer Principal

See how this role matches your resume

Sign in to get an AI match score and personalized feed.

Create account Sign in

More in Engineering

Product Fintech SaaS Remote-first Berlin