Security Operations

• Administer and engineer improvements to enterprise security telemetry and detection platforms, including SIEM, EDR, SOAR, and data pipeline solutions
• Implement secure-by-default telemetry patterns and logging standards across operating systems, cloud, and network data sources
• Design, build, and maintain high-throughput data pipelines for log routing, enrichment, filtering, and transformation into SIEM, archive, and other destinations
• Engineer SIEM content including SPL searches, correlation rules, alerts, dashboards, data models, CIM mapping, and RBA where applicable
• Define and maintain RBAC, least-privilege models, and user provisioning across telemetry and detection platforms
• Integrate and automate SOC tooling and enterprise systems, including Tines, AWS/Azure/GCP logging, threat intelligence feeds, and ITSM systems
• Author and maintain system design documents, reference implementations, runbooks, and technical decision records
• Troubleshoot complex SIEM/EDR and pipeline issues, reduce noise, and close visibility gaps
• Support incident response through targeted searches, log analysis, root-cause identification, and platform expertise during high-severity events
• Improve control validation, data quality checks, parsing and field-extraction tests, content regression tests, and platform observability
• Evaluate emerging telemetry sources, detection approaches, and vendor capabilities; build proofs of concept
• Support identity, access, and privilege strategies, including API tokens, service accounts, secrets management, SSO/SAML/OIDC
• Translate post-incident findings into backlog items for pipeline hardening, new log sources, and content tuning
• Contribute to responsible logging and monitoring for AI-enabled applications and platforms
• Represent security telemetry and detection engineering for the Global Security Office in technical forums
• Perform other duties as assigned

Staff SOC Engineer – Security Telemetry, Detection Platforms

• Provide CSOC Tier 1 services for containment, eradication, and recovery of events and incidents
• Record, investigate, and process events received via walk-ups, phone, email, chat, web, cybersecurity tools, and enterprise tools
• Perform 24/7 monitoring, detection, and initial triage using the SIEM
• Identify, investigate, categorize, prioritize, ticket, and forward events, alerts, and incidents
• Create tickets in the agency-directed ticketing system
• Aggregate artifacts, data, screenshots, and other products for higher-tier analysis
• Submit tuning requests to security and cybersecurity analysis services
• Interact with CSOC customers through walk-ins, phones, web, email, and text-based chat
• Document analysis and triage steps for reconstruction after Tier 1 analysis
• Monitor the CSOC virus submission mailbox and assess emails for spam, phishing, or malware
• Provide custom metrics for regular and ad hoc reporting
• Provide input to daily Significant Activity, daily Operations Update, and Weekly Status reports

Security Operations jobs in Missouri

Staff SOC Engineer – Security Telemetry, Detection Platforms

Cyber Security Operations Specialist I – Tier 1