Cybersecurity Engineer

Explore a World of Opportunity with the State of Georgia!

We are the force that drives Georgia!
Georgia State Government is a large enterprise, composed of various agencies and entities with a common goal to improve the lives of Georgia's more than 10 million citizens!
Join Team Georgia and impact lives everyday while receiving a robust benefits package designed for every stage of your career! 

Job Title:

Cybersecurity Engineer

Agency:

Department of Early Care and Learning

Job Requisition ID:

JR0000007759

Shift:

Day (United States of America)

Compensation Details:

$76,821.60 - $110,000.00

Job Description:

Salary: $76,821.60 - $110,000

Commensurate with experience and education.

Job Code: ISP012

Pay Grade: P

Location: Headquarters-Based, Atlanta, Ga (REMOTE)

Bright from the Start: Georgia Department of Early Care and Learning is responsible for meeting the child care and early education needs of Georgia's children and their families. It administers the nationally recognized Georgia's Pre-K Program, licenses child care centers and home-based child care, administers Georgia Childcare and Parent Services (CAPS), federal nutrition programs, and manages Quality Rated, Georgia's community-powered child care rating system.

The department also houses the Head Start State Collaboration Office, distributes federal funding to enhance the quality and availability of child care, and works collaboratively with child care resource and referral agencies and organizations throughout Georgia to enhance early care and education.

Job Description:

We are seeking a skilled and proactive Cybersecurity Engineer to serve as DECAL's lead technical resource for Security Operations Engineering and cybersecurity monitoring technologies. This position is responsible for the engineering, administration, and continuous improvement of DECAL's Security Operations capabilities, including security monitoring, threat detection, cybersecurity automation, incident response coordination, vulnerability and exposure management, and assigned security operations technologies.

The Cybersecurity Engineer provides technical leadership for Microsoft Sentinel, Microsoft Defender, detection engineering, threat hunting, vulnerability management, email security technologies, and cybersecurity incident response. The position partners with Governance, Risk and Compliance (GRC), Legal, Information Technology Operations, Application Development, and business stakeholders to improve security visibility, operational readiness, and cybersecurity maturity.

Job Duties:

Security Operations Engineering

• Lead administration, configuration, optimization, and continuous improvement of security operations platforms and services.

• Engineer and maintain security monitoring, threat detection, automation, and response capabilities.

• Configure, maintain, and optimize security data sources, telemetry collection, security connectors, and monitoring integrations supporting DECAL Security Operations.

• Develop and optimize analytics rules, alerts, dashboards, workbooks, automation workflows, and response playbooks.

• Manage security telemetry collection, event correlation, and monitoring visibility across security and enterprise platforms.

• Develop scripting and automation solutions to improve operational efficiency, detection, and response.

• Continuously improve monitoring coverage, operational effectiveness, and Security Operations maturity.

Detection Engineering and Threat Hunting

• Develop, tune, and maintain threat detections, monitoring use cases, analytical content, and MITRE ATT&CK-aligned detection coverage.

• Conduct proactive threat hunting, Indicator of Compromise (IOC) analysis, and advanced security investigations.

• Analyze threat intelligence, attack techniques, and security events to identify emerging threats and improve detection effectiveness.

• Perform root cause analysis and incorporate lessons learned into monitoring and response capabilities.

Vulnerability and Exposure Management

• Lead technical vulnerability and exposure management activities across the enterprise.

• Manage Microsoft Defender Vulnerability Management, Azure Secure Score, Defender for Cloud recommendations, exposure reduction, remediation tracking, and security posture reporting.

• Coordinate with infrastructure, application, and business teams to prioritize and address security findings and recommendations.

• Validate remediation and support implementation of technical recommendations and compensating controls.

Incident Response

• Serve as the technical lead and organizer for cybersecurity investigations and incident response activities.

• Coordinate technical response, evidence collection, containment, eradication, and recovery support.

• Maintain incident documentation, facilitate after-action reviews, and translate lessons learned into operational improvements.

• Function as an escalation resource for complex cybersecurity events, investigations, and technical security challenges.

Email Security Administration

• Administer and maintain email security technologies supporting DECAL cybersecurity operations.

• Manage security capabilities, policies, monitoring, and threat response associated with Exchange Online Protection (EOP), Microsoft Defender for Office 365, and Barracuda Email Security.

• Investigate phishing, malware, business email compromise, and other email-based security events.

• Develop and maintain email security monitoring, detection, and response capabilities.

Technical Leadership and Collaboration

• Provide technical mentoring, training, and guidance to cybersecurity personnel and future Security Operations staff without direct supervisory responsibility.

• Develop operational standards, runbooks, procedures, and knowledge-sharing materials.

• Support governance, compliance, audit, and risk management through technical implementation, documentation, evidence collection, remediation support, and subject matter expertise.

• Participate in security reviews for new technologies and provide monitoring, detection, logging, vulnerability management, and incident response requirements.

• Provide backup coverage for Microsoft Purview capabilities through cross-training and documented procedures.

Additional Duties

• Participate in cross-training and continuity efforts supporting cybersecurity operations and assigned security technologies.

• Support cybersecurity awareness and operational readiness initiatives.

• Perform all other duties as assigned.

Technical Skills:

Demonstrated experience supporting, administering, engineering, securing, or connecting multiple cybersecurity technologies across security operations, monitoring, threat detection, vulnerability management, email security, automation, and incident response. Candidates are not expected to possess experience with every technology listed. Experience across a significant portion of the following technologies and capabilities is desired:

• Microsoft Sentinel.

• Microsoft Defender Security Suite (Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud, Defender for Cloud Apps, Defender Vulnerability Management).

• Microsoft Azure Security Services (Azure Monitor, Azure Log Analytics, Azure Logic Apps, Azure Policy, Azure Secure Score, Security Recommendations, security monitoring, automation, and exposure management).

• Microsoft Entra ID.

• Exchange Online Protection (EOP) and Barracuda Email Security.

• Kusto Query Language (KQL).

• PowerShell, Python, or another scripting language used for security automation and orchestration.

• APIs and security connector technologies used for telemetry ingestion and workflow automation.

• Security Information and Event Management (SIEM) and Extended Detection and Response (XDR).

• MITRE ATT&CK mapping, threat hunting, threat intelligence, and IOC analysis.

• Incident response, vulnerability management, and exposure management.

• Cloud Security Posture Management (CSPM), cloud security recommendations, and remediation coordination.

• Security monitoring or telemetry ingestion for AWS, GCP, ServiceNow, Salesforce, or other enterprise platforms.

Preferred candidates will demonstrate hands-on experience with approximately 50% or more of the technologies and capabilities listed above, with particular emphasis on Microsoft Sentinel, Microsoft Defender, security monitoring, detection engineering, threat hunting, vulnerability management, email security, automation, and incident response.

Personal Skills

• Must be well organized, efficient, and able to work independently under their own initiative.

• Must work effectively as part of a lean, collaborative team.

• Ability to react calmly, quickly, and efficiently under pressure.

• Strong written and verbal communication skills for reporting to management and other stakeholders.

• Demonstrated ability to lead technical work, mentor others, and document repeatable processes.

Physical Position Requirements:

• Work is typically performed in an office or remote-work environment with intermittent sitting, standing, or walking in various settings.

• The ability to speak clearly, hear and understand at a normal conversational level, and receive detailed information through verbal communication.

• Close visual acuity to prepare and analyze data, view a computer terminal, perform extensive reading, and conduct visual inspection.

• Full range of hand and finger motion for data-entry purposes.

Required Qualifications:

Bachelor's degree in Computer Science/Information Technology/Information Security or related field or equivalent experience and four (4) years of proven experience and demonstrated success in technology leadership with emphasis on information security and data governance and currently holds an Advanced Level cyber certification per state guidelines or achieves within 12 months of start date: (CISSP, CISA, CISM, GCIH, GCED, GSLC) and must hold or be able to qualify for a US Department of Homeland Security (DHS) clearance.

DECAL Preferred Qualifications:

• Experience serving as a senior engineer, technical lead, subject matter expert, or mentor within a Security Operations environment.

• Hands-on experience across approximately 50% or more of the technologies and capabilities listed in the Technical Skills section, with strong experience in Microsoft Sentinel and Microsoft Defender.

• Experience with security monitoring, detection engineering, MITRE ATT&CK mapping, threat hunting, IOC analysis, incident response, vulnerability management, email security administration, KQL, scripting, and security orchestration.

• Understanding of cybersecurity and compliance frameworks (NIST SP 800-53, CJIS Security Policy, IRS Publication 1075, FedRAMP, GovRAMP, State cybersecurity standards, or similar control-based environments).

• Industry certifications (SC-200, AZ-500, SC-100, CISSP, CISM, or equivalent).

Benefits working at Decal: 

• Vacation: 15 days each year up to 5 years of service

·       Sick Leave – 15 days each year

·       Holidays – the state of Georgia recognizes 13 paid holidays

·       Retirement

·   401(k) plan with a matching employer contribution

·   Defined Benefit Pension Plan

·       Available Insurance

·   Health

·   Dental

·   Vision

·   Legal

·   Disability

·   Healthcare & Childcare spending accounts

·   Life & dependent life insurance

Bright from the Start: Georgia Department of Early Care and Learning is an equal opportunity employer and drug-free workplace.  A background check will be completed upon hire, which may consist of any or all of the following: criminal and employment histories, credit history (as applicable to the position), education credentials, and motor vehicle driving records.

Bright from the Start:  Georgia Department of Early Care and Learning is an equal opportunity employer.

Minimum Qualifications:

Bachelor's degree in Computer Science/Information Technology/Information Security or related field or equivalent experience and four (4) years of proven experience and demonstrated success in technology leadership with emphasis on information security and data governance and currently holds an Advanced Level cyber certification per state guidelines or achieves within 12 months of start date: (CISSP, CISA, CISM, GCIH, GCED, GSLC) and must hold or be able to qualify for a US Department of Homeland Security (DHS) clearance.

Equal Employment Opportunity Employer

The State of Georgia does not discriminate based on race, color, national origin, sex, religion, age, disability, or other protected categories in employment or the provision of services.
Qualified applicants may request reasonable accommodation when needed during the application and/or screening process by contacting the appropriate agency Human Resources department.