Security Architect - Consultant - Fully REMOTE - Must have MITRE ATT, CK Framework experience

Daily Duties / Responsibilities:

PREFERENCE WILL BE GIVEN TO A CANDIDATE WHO CAN WORK ONSITE OVER HYBRID AND OVER FULL-TIME REMOTE (ON-SITE AS NEEDED).

• Review and tune current detection rules within the State SIEM.
• Perform Gap analysis of the current detection coverage.
• Develop detection rules/solutions to cover found Gaps.
• monitor threat intelligence sources for new use cases.
• Work with State SOC analysts to create and tune rules.
• Work with the State Threat Hunter to identify and remediate detection coverage gaps.
• Document processes, runbooks, and troubleshooting steps related to the SOAR and integrations.
• Coordinate with engineering, SOC, and agency staff as needed to meet goals.
• Other duties as needed.

Additional skills and duties:

• Proven experience with detection tuning/DEVELOPMENT.
• Experience with dashboard creation and reporting.
• Excellent communication and customer service skills for agency-facing engagement.
• Experience in working in multi-tenancy environment
• Experience in multi-agency or enterprise service projects.

Preferred Skills (rank in order of Importance):

• Experience with the Palo Alto Cortex XSIAM platform.
• Deep understanding of Windows/Linux artifacts.

Required Education/Certifications:

• BACHELOR'S DEGREE IN AN INFORMATION TECHNOLOGY OR INFORMATION SECURITY RELATED FIELD
• EIGHT YEARS OF RELEVANT WORK EXPERIENCE MAY BE SUBSTITUTED IN LIEU OF EDUCATION
• FIVE YEARS OF EXPERIENCE IN SUPPORTING LARGE IT ENVIRONMENTS AND/OR SYSTEM DEPLOYMENTS
• 5 years of Strong scripting and automation skills (Python, Bash, PowerShell, or similar).
• Understanding of Sigma, YARA, and other industry standard detection languages.
• Familiarity with MITRE ATT&CK framework

Preferred Education/Certifications:

• CISSP, CISA, CISO or equivalent advanced security certification.
• Additional relevant certifications (e.g., CEH, OSCP, GPEN).
• VENDOR CERTIFICATIONS IN DETECTION ENGINEERING.
• Resource is local to Columbia, South Carolina or a surrounding city in South Carolina