Req ID: RQ232148
Type of Requisition: Regular
Clearance Level Must Be Able to Obtain: Top Secret/SCI
Public Trust/Other Required: None
Job Family: Cyber and IT Risk Management
Skills:
Cloud Based Solutions,Critical Infrastructure Security,Firewall Security
Certifications:
Splunk Enterprise Certified Admin | Splunk - Splunk, CompTIA Security+ CE | CompTIA - CompTIA
Experience:
5 + years of related experience
US Citizenship Required:
Yes
Job Description:
Transform technology into opportunity as a Cybersecurity Infrastructure - Lead with GDIT. A career in enterprise IT means connecting and enhancing the systems that matter most. At GDIT you'll be at the forefront of innovation and play a meaningful part in improving how agencies operate.
At GDIT, people are our differentiators. As a Cybersecurity Infrastructure - Lead , you will help ensure today is safe and tomorrow is smarter. Our work depends on a Cybersecurity Systems Administrator - Lead joining our team to provide cyber technical support for the Cyber Security Operations Center (CSOC).
HOW A CYBERSECURITY INFRASTRUCTURE LEAD WILL MAKE AN IMPACT
Support will consist of configuring, tuning, optimizing, and maintaining critical security infrastructure to safeguard the organization's digital assets against evolving cyber threats.
You'll be responsible for overseeing the operation, architecture alignment, and maintenance of essential cybersecurity systems, including:
Enterprise Firewalls and boundary protection controls
Cloud-based Internet Isolation (CBII) / Remote Browser Isolation (RBI) platforms
Network Intrusion Detection/Prevention Systems (IDS/IPS) built on Security Onion (Suricata, Zeek)
Network packet brokers and visibility fabric using Gigamon TAPs
Security Information and Event Management (SIEM) technologies (Splunk)
Endpoint Detection & Response (EDR) systems
Network Access Control (NAC) policies
Security Orchestration, Automation, and Response (SOAR) platforms
WHAT YOU'LL NEED TO SUCCEED:
Education: Bachelor's degree in Information Systems, Computer Science, Computer Engineering, Cybersecurity, or another related field. Relevant work experience may be considered in lieu of a degree.
Certification(s): Applicable DoD 8140 or DoD 8570 Certification (e.g., Security+ CE, CySA+, CASP+, CISSP, or relevant CSSP role certifications).
Required Experience: 5+ years of experience in cybersecurity infrastructure administration and engineering, with hands-on focus in:
Configuring and managing next-generation firewalls (NGFW) and boundary security policies.
Administering Cloud-based Internet Isolation (CBII) and web proxy solutions.
Deploying, tuning, and operating IDS/IPS sensors via Security Onion and managing network visibility fabrics using Gigamon hardware/virtual TAPs.
Configuring and managing SIEM, EDR, NAC, and SOAR platforms.
Security Clearance Level: TS/SCI
Location: On-site in Tampa, FL
Citizenship: U.S. Citizenship Required
REQUIRED TECHNICAL SKILLS:
Operating Systems & Scripting: Proficiency in Linux environments (RHEL, Ubuntu/Debian), including system administration, package management, and shell scripting (Bash, Python) for automation and log pipeline customization.
Network Security & Visibility:
Deep understanding of TCP/IP networking, packet analysis, traffic aggregation, filtering, and flow distribution using packet brokers and TAP infrastructure.
Hands-on expertise managing and tuning Security Onion architecture, including Suricata signature tuning, Zeek network analysis, and sensor deployment.
Robust knowledge of Next-Generation Firewalls (NGFW) rule base management, NAT policies, SSL/TLS inspection, and perimeter access controls.
Experience administering Cloud-Based Internet Isolation (CBII) or Secure Web Gateways (SWG) to safeguard users from web-borne threats.
Threat Landscapes & Tuning: Solid understanding of cybersecurity principles, MITRE ATT&CK framework, threat vectors, and detection engineering best practices across perimeter, network, and endpoint tools.
Analytical & Troubleshooting: Strong analytical skills with the ability to troubleshoot complex packet drop, network routing, sensor capture, and tool pipeline performance issues.
Professional Attributes: Excellent communication and collaboration skills; demonstrated ability to work independently, prioritize high-impact operational tasks, and meet critical deliverables in a dynamic CSOC environment.
REQUIRED SKILLS AND ABILITIES:
-
Configuration and Optimization
Firewalls & Perimeter Defense: Manage, configure, and audit enterprise firewall rule sets, ensure defense-in-depth posture, and enforce strict ingress/egress filtering policies.
Cloud-Based Internet Isolation (CBII): Administer and optimize CBII policies, ensuring seamless secure web browsing, policy enforcement, and isolation of high-risk external web sessions.
Network IDS/IPS & TAPs:
Deploy, manage, and scale Gigamon TAPs and network packet broker fabrics to aggregate, filter, de-duplicate, and route high-throughput network traffic efficiently to inspection tools.
Deploy and maintain Security Onion sensor grids across multiple security enclaves; optimize Suricata IDS/IPS detection rulesets and Zeek protocol parsing scripts to minimize false positives and maximize threat visibility.
SIEM, EDR & NAC:
Deploy, configure, and maintain clustered SIEM (Splunk) environments, search queries, dashboards, and correlation alerts.
Fine-tune EDR policies, sensor configurations, and scanning parameters to maintain comprehensive host visibility.
Configure and enforce Network Access Control (NAC) policies to mitigate unauthorized device connectivity.
Data Integration: Ingest and normalize logs from firewalls, Gigamon metadata, Security Onion alerts, CBII telemetry, and endpoint sensors into SIEM and central monitoring stacks.
-
Maintenance and Support
Perform routine preventative maintenance, software upgrades, firmware updates, OS patching, and performance tuning across firewalls, Gigamon appliances, Security Onion sensors, and central management servers.
Monitor traffic throughput, tap drop rates, sensor health, and resource utilization across network security appliances to guarantee continuous, zero-blind-spot visibility.
Provide tiered escalation support and troubleshooting for operational incidents affecting boundary protections, isolation sessions, or sensor pipelines, coordinating with hardware and software vendors as required.
Perform regular system audits and vulnerability assessments of security tools, implementing corrective remediation actions and hardening benchmarks (e.g., DISA STIGs).
Prepare technical briefings and operational capability demonstrations for CSOC and program leadership.
-
Policy Development, Integration, and Compliance
Develop, document, and enforce standard operating procedures (SOPs), configuration baselines, and security policies governing firewalls, sensor tap points, and isolated browser workflows in accordance with DoD and agency guidelines.
Collaborate with audit and compliance teams to ensure boundary defenses, network monitoring tools, and log retention satisfy FISMA/DoD compliance mandates and RMF controls.
Integrate network detection platforms (Security Onion, Firewalls) with the SOAR environment to trigger automated enrichment, dynamic IP blocking, and rapid containment workflows.
Design, implement, and maintain custom SOAR playbooks that accelerate CSOC triage for high-fidelity alerts generated by boundary and IDS appliances.
-
Training and Knowledge Sharing
Author and maintain engineering documentation, network architecture diagrams, and operational runbooks for firewall rules, Gigamon map configurations, and Security Onion deployments.
Provide training and technical mentoring to CSOC Tier 1/2 analysts on querying network metadata (Zeek), evaluating IDS alerts (Suricata), and interpreting isolation session telemetry.
Foster cross-functional collaboration and knowledge-sharing within the cybersecurity engineering team.
PREFERRED SKILLS:
Prior CENTCOM / Combatant Command (COCOM) operational environment experience.
Vendor-specific certifications (e.g., Gigamon Certified Professional, Palo Alto PCNSE / Fortinet NSE, Security Onion training).
Splunk Enterprise Certified Admin or Power User certification.
Practical background in Threat Hunting, Network Traffic Analysis (PCAP analysis, Wireshark), or CSOC analyst roles.
Deep experience in hardening systems against DISA STIGs within DoD TS/SCI enclaves.
GDIT IS YOUR PLACE:
401(k) with company match
Comprehensive health and wellness packages
Internal mobility team dedicated to helping you own your career
Professional growth opportunities including paid education and certifications
Cutting-edge technology you can learn from
Rest and recharge with paid vacation and holidays
centcomcits
gditpriority
The likely salary range for this position is $144,500 - $195,500. This is not, however, a guarantee of compensation or salary. Rather, salary will be set based on experience, geographic location and possibly contractual requirements and could fall outside of this range.
Total Rewards at GDIT:
Our benefits package for all US-based employees includes a variety of medical plan options, some with Health Savings Accounts, dental plan options, a vision plan, and a 401(k) plan offering the ability to contribute both pre and post-tax dollars up to the IRS annual limits and receive a company match. To encourage work/life balance, GDIT offers employees full flex work weeks where possible and a variety of paid time off plans, including vacation, sick and personal time, holidays, paid parental, military, bereavement and jury duty leave. To ensure our employees are able to protect their income, other offerings such as short and long-term disability benefits, life, accidental death and dismemberment, personal accident, critical illness and business travel and accident insurance are provided or available. We regularly review our Total Rewards package to ensure our offerings are competitive and reflect what our employees have told us they value most.
Our Identity Verification Process:
As part of the hiring process, we will ask you to complete an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud. You are expected to be on camera during virtual interviews. We reserve the right to take your picture to verify your identity and prevent fraud. By proceeding, you authorize the collection, processing, and use of your biometric data for identity verification and security purposes.
About Our Work:
We are GDIT. A global technology and professional services company that delivers technology solutions and mission services to every major agency across the U.S. government, defense and intelligence community. Our 26,000 experts extract the power of technology to create immediate value and deliver solutions at the edge of innovation. We operate across 50+ countries worldwide, offering leading mission-ready capabilities in AI, cloud, cyber and software development.
Join our Talent Community to stay up to date on our career opportunities and events at https://gdit.com/tc.
Equal Opportunity Employer / Individuals with Disabilities / Protected Veterans
