Cybersecurity Infrastructure - Lead

Clearance Level Must Currently Possess:

Clearance Level Must Be Able to Obtain:

Job Family:

Job Description:

Transform technology into opportunity as a Cybersecurity Infrastructure - Lead with GDIT. A career in enterprise IT means connecting and enhancing the systems that matter most. At GDIT you’ll be at the forefront of innovation and play a meaningful part in improving how agencies operate.

At GDIT, people are our differentiators. As a Cybersecurity Infrastructure – Lead, you will help ensure today is safe and tomorrow is smarter. Our work depends on a Cybersecurity Systems Administrator - Lead joining our team to provide cyber technical support for the Cyber Security Operations Center (CSOC).

Support will consist of configuring, tuning, optimizing, and maintaining critical security infrastructure to safeguard the organization's digital assets against evolving cyber threats.

You'll be responsible for overseeing the operation, architecture alignment, and maintenance of essential cybersecurity systems, including:

• Enterprise Firewalls and boundary protection controls
• Cloud-based Internet Isolation (CBII) / Remote Browser Isolation (RBI) platforms
• Network Intrusion Detection/Prevention Systems (IDS/IPS) built on Security Onion (Suricata, Zeek)
• Network packet brokers and visibility fabric using Gigamon TAPs
• Security Information and Event Management (SIEM) technologies (Splunk)
• Endpoint Detection & Response (EDR) systems
• Network Access Control (NAC) policies
• Security Orchestration, Automation, and Response (SOAR) platforms

• Education: Bachelor’s degree in Information Systems, Computer Science, Computer Engineering, Cybersecurity, or another related field. Relevant work experience may be considered in lieu of a degree.
• Certification(s): Applicable DoD 8140 or DoD 8570 Certification (e.g., Security+ CE, CySA+, CASP+, CISSP, or relevant CSSP role certifications).
• Required Experience: 5+ years of experience in cybersecurity infrastructure administration and engineering, with hands-on focus in:
  • Configuring and managing next-generation firewalls (NGFW) and boundary security policies.
  • Administering Cloud-based Internet Isolation (CBII) and web proxy solutions.
  • Deploying, tuning, and operating IDS/IPS sensors via Security Onion and managing network visibility fabrics using Gigamon hardware/virtual TAPs.
  • Configuring and managing SIEM, EDR, NAC, and SOAR platforms.
• Security Clearance Level: TS/SCI
• Location: On-site in Tampa, FL
• Citizenship: U.S. Citizenship Required

• Operating Systems & Scripting: Proficiency in Linux environments (RHEL, Ubuntu/Debian), including system administration, package management, and shell scripting (Bash, Python) for automation and log pipeline customization.
• Network Security & Visibility:
  • Deep understanding of TCP/IP networking, packet analysis, traffic aggregation, filtering, and flow distribution using packet brokers and TAP infrastructure.
  • Hands-on expertise managing and tuning Security Onion architecture, including Suricata signature tuning, Zeek network analysis, and sensor deployment.
  • Robust knowledge of Next-Generation Firewalls (NGFW) rule base management, NAT policies, SSL/TLS inspection, and perimeter access controls.
  • Experience administering Cloud-Based Internet Isolation (CBII) or Secure Web Gateways (SWG) to safeguard users from web-borne threats.
• Threat Landscapes & Tuning: Solid understanding of cybersecurity principles, MITRE ATT&CK framework, threat vectors, and detection engineering best practices across perimeter, network, and endpoint tools.
• Analytical & Troubleshooting: Strong analytical skills with the ability to troubleshoot complex packet drop, network routing, sensor capture, and tool pipeline performance issues.
• Professional Attributes: Excellent communication and collaboration skills; demonstrated ability to work independently, prioritize high-impact operational tasks, and meet critical deliverables in a dynamic CSOC environment.

• Firewalls & Perimeter Defense: Manage, configure, and audit enterprise firewall rule sets, ensure defense-in-depth posture, and enforce strict ingress/egress filtering policies.
• Cloud-Based Internet Isolation (CBII): Administer and optimize CBII policies, ensuring seamless secure web browsing, policy enforcement, and isolation of high-risk external web sessions.
• Network IDS/IPS & TAPs:
  • Deploy, manage, and scale Gigamon TAPs and network packet broker fabrics to aggregate, filter, de-duplicate, and route high-throughput network traffic efficiently to inspection tools.
  • Deploy and maintain Security Onion sensor grids across multiple security enclaves; optimize Suricata IDS/IPS detection rulesets and Zeek protocol parsing scripts to minimize false positives and maximize threat visibility.
• SIEM, EDR & NAC:
  • Deploy, configure, and maintain clustered SIEM (Splunk) environments, search queries, dashboards, and correlation alerts.
  • Fine-tune EDR policies, sensor configurations, and scanning parameters to maintain comprehensive host visibility.
  • Configure and enforce Network Access Control (NAC) policies to mitigate unauthorized device connectivity.
• Data Integration: Ingest and normalize logs from firewalls, Gigamon metadata, Security Onion alerts, CBII telemetry, and endpoint sensors into SIEM and central monitoring stacks.

• Perform routine preventative maintenance, software upgrades, firmware updates, OS patching, and performance tuning across firewalls, Gigamon appliances, Security Onion sensors, and central management servers.
• Monitor traffic throughput, tap drop rates, sensor health, and resource utilization across network security appliances to guarantee continuous, zero-blind-spot visibility.
• Provide tiered escalation support and troubleshooting for operational incidents affecting boundary protections, isolation sessions, or sensor pipelines, coordinating with hardware and software vendors as required.
• Perform regular system audits and vulnerability assessments of security tools, implementing corrective remediation actions and hardening benchmarks (e.g., DISA STIGs).
• Prepare technical briefings and operational capability demonstrations for CSOC and program leadership.

• Develop, document, and enforce standard operating procedures (SOPs), configuration baselines, and security policies governing firewalls, sensor tap points, and isolated browser workflows in accordance with DoD and agency guidelines.
• Collaborate with audit and compliance teams to ensure boundary defenses, network monitoring tools, and log retention satisfy FISMA/DoD compliance mandates and RMF controls.
• Integrate network detection platforms (Security Onion, Firewalls) with the SOAR environment to trigger automated enrichment, dynamic IP blocking, and rapid containment workflows.
• Design, implement, and maintain custom SOAR playbooks that accelerate CSOC triage for high-fidelity alerts generated by boundary and IDS appliances.

• Author and maintain engineering documentation, network architecture diagrams, and operational runbooks for firewall rules, Gigamon map configurations, and Security Onion deployments.
• Provide training and technical mentoring to CSOC Tier 1/2 analysts on querying network metadata (Zeek), evaluating IDS alerts (Suricata), and interpreting isolation session telemetry.
• Foster cross-functional collaboration and knowledge-sharing within the cybersecurity engineering team.

• Prior CENTCOM / Combatant Command (COCOM) operational environment experience.
• Vendor-specific certifications (e.g., Gigamon Certified Professional, Palo Alto PCNSE / Fortinet NSE, Security Onion training).
• Splunk Enterprise Certified Admin or Power User certification.
• Practical background in Threat Hunting, Network Traffic Analysis (PCAP analysis, Wireshark), or CSOC analyst roles.
• Deep experience in hardening systems against DISA STIGs within DoD TS/SCI enclaves.

• 401(k) with company match
• Comprehensive health and wellness packages
• Internal mobility team dedicated to helping you own your career
• Professional growth opportunities including paid education and certifications
• Cutting-edge technology you can learn from
• Rest and recharge with paid vacation and holidays

#centcomcits

#gditpriority

Scheduled Weekly Hours:

Work Location:

Additional Work Locations:

gdit.com/tc.