Remote role - Security Architect

Security Architect

Location: Remote
Duration of the Contract: 12 months
Possibility for Extension: Yes
Daily Duties / Responsibilities:
Proven experience with detection tuning/development.
Experience with dashboard creation and reporting.
Additional Skills and Duties:
Review and tune current detection rules within the State SIEM.
Perform gap analysis of the current detection coverage.
Develop detection rules/solutions to cover found gaps.
Monitor threat intelligence sources for new use cases.
Work with State SOC analysts to create and tune rules.
Work with the State Threat Hunter to identify and remediate detection coverage gaps.
Document processes, runbooks, and troubleshooting steps related to the SOAR and integrations.
Coordinate with engineering, SOC, and agency staff as needed to meet goals.
Other duties as needed.
Preferred Skills (Ranked by Importance):
Experience with the Palo Alto Cortex XSIAM platform.
Deep understanding of Windows/Linux artifacts.
Excellent communication and customer service skills for agency-facing engagement.
Experience working in a multi-tenancy environment.
Experience in multi-agency or enterprise service projects.
Required Education / Certifications:
Bachelor's Degree in an Information Technology or Information Security related field.
Eight years of relevant work experience may be substituted in lieu of education.
Five years of experience supporting large IT environments and/or system deployments.
5+ years of strong scripting and automation skills (Python, Bash, PowerShell, or similar).
Understanding of Sigma, YARA, and other industry-standard detection languages.
Familiarity with MITRE ATT&CK framework.
Preferred Education / Certifications:
CISSP, CISA, CISO, or equivalent advanced security certification.
Additional relevant certifications (e.g., CEH, OSCP, GPEN).
Vendor certifications in Detection Engineering.
Preference will be given to a candidate who can work onsite over hybrid and over full-time remote (on-site as needed).