Cyber Engineer Principal

SAIC has an opening for a highly hands-on, Principal Cyber Engineer who lives and breathes this work—the SME for SMEs. The ideal candidate is someone who experiments at home, maintains a personal mixed OS lab, and genuinely enjoys tinkering with new and opensource security tools, building and breaking environments to learn how things work. This role is well-suited to someone who genuinely enjoys exploring new security capabilities, testing ideas, coding up useful experiments/aides/queries/skills/scripts with AI, and learning emerging patterns in Zero Trust, cloud security, AI platforms, and security data engineering.

***This is a Remote role but candidates must live within commuting range of Reston, VA. Work is primarily from home, but frequently in customer spaces in Virginia or D.C., at the proposal center in Reston, at the Air Force Business Group in Crystal City, or on occasional travel. Candidates must be able to travel occasionally on short notice to support internal and external customer needs.***

Assignments range from two-days to 50 percent time for nine months. Travel is occasional and usually short; some trips come on short notice; occasional trips can last up to six weeks, with longer trips planned in advance. Candidates must have an active Top Secret clearance, with SCI eligibility.

Responsibilities:

- Enter customer spaces on short cycle. Learn the stack and the people in days. Leave usable artifacts, not just a briefing deck.
- If the space is new, thin, or stuck, drive the cyber team, then hand it back runnable. Consult contract cyber leads; do not replace them.
- Assess cyber programs and customer environments against applicable cyber and security frameworks. Recommend solutions, modernization, automation, and next steps to mature the innovation space.
- Work in Zero Trust, AI platform security, data engineering for security telemetry, and SIEM / SOC architecture and automation. Support growing efforts in AI governance and securing AI agents and tool gateways.
- Apply RMF, CMMC, and ICD-705 in live spaces. Support incident response. Engineer and tune security and cloud architecture, endpoint platforms, DLP, IPS, and load-balancer / traffic paths.
- Treat time-indexed data (what happened) and stateful data (what is true now) as complementary, and use platforms and vendor relationships so both exist and feed Zero Trust activity targets.
- Troubleshoot with CLI first—Windows, Linux, security-tool CLIs, AWS Console and AWS CLI. Escalate with evidence.
- Teach. Present white papers. Write job aids for new and old frameworks. Contribute technically to proposals.

- Bachelor’s degree and 9 years of experience, or A Master’s degree and 7 years of experience.
- U.S. citizen with an active Top Secret clearance and the ability to obtain SCI.
- Must live within commuting range of Reston, VA. Work is primarily from home, with regular time in VA/D.C. customer spaces, the Reston proposal center, AF BG Crystal City, and occasional travel (some short notice).
- Current CompTIA Security+ CE or equivalent 8140 intermediate certification.
- Typically 8+ years of hands-on cyber engineering, SOC / SIEM architecture, enablement, or equivalent at Senior Principal depth. Must be able to drive a team and advise a contract cyber lead.
- Experience assessing cyber programs and environments against cyber and security frameworks, then recommending solutions, modernization, and automation. Proven work in customer spaces, including mixed classification, on a support-request cadence. Occasional travel; some short notice.
- Technical depth in Zero Trust and AI platforms; data engineering applied to security telemetry; SIEM automation or SOC tooling and architecture. Splunk experience strongly preferred.
- Working familiarity within RMF, CMMC, ICD-705, incident response, security architecture, cloud security architecture, endpoint security platforms, DLP, IPS, and load balancers.
- Can clearly explain time-indexed vs. stateful data, why a security environment needs both, and how tooling and vendors provide both for Zero Trust activity targets.
- Strong troubleshooting skills. Current CLI on Windows and Linux (PowerShell, Bash or equivalent). Hands-on AWS Console and AWS CLI (IAM, CloudTrail, GuardDuty, Security Hub, VPC / flow logs, S3, CloudWatch or equivalent).
- Communicates and teaches cleanly. Writes job aids and presents to mixed audiences (technical and non-technical).

Desired Qualifications

- Current SCI; TS/SCI with Poly is a plus for the high end of the Service Delivery customers. Splunk Certified Admin, higher, or equivelant for security data engineering knowledge and experience yet not biased to any one tool. (Splunk, elastic, sentinal, etc…)
- CISSP or higher (ISSAP, ISSEP, or ISSMP) to cover GRC related assignments
- Additional current credentials in cloud, detection, architecture, or data (CCSP, CISM, GIAC, AWS / Azure security, CySA+ / CASP+, or equivalent).
- Proposal / capture technical consulting; published or internal white papers; prior enablement of mixed-skill cyber teams.
- Budding interest in AI governance and in securing AI agents and tool gateways.
- Experience with SOAR, EDR / XDR, identity platforms, security data lakes, and securing AI / ML platforms (Azure OpenAI, Bedrock, on-prem model hosting, RAG / LLMOps controls).