Dragonfli Group

Security Engineer

• Assist in developing playbooks, workflows, and implementation roadmaps to mature the Insider Threat operational support program.
• Administer and optimize the Insider Risk toolset, specifically DLP, UEBA, SIEM, and Microsoft Defender/Entra/Purview.
• Develop and maintain a convergence model to reduce risk to personnel and assets across regional operating divisions.
• Lead and assist in the investigation of all incidents involving potential insider threats.
• Coordinate with business and technology leaders to develop programmatic solutions and deliver high-level presentations on findings.
• Implement federal government and industry standards regarding insider threat programs and maintain programmatic gap analyses.

Security Engineer – Insider Risk

Threat Intelligence Specialist

• Perform triage on security escalations and detections to determine scope, severity, and root cause; monitor cybersecurity events and investigate incidents efficiently.
• Identify, recommend, and implement automation use cases leveraging AI/ML capabilities to accelerate response times.
• Support the deployment, configuration, testing, and maintenance of the Security Orchestration, Automation, and Response (SOAR) platform, specifically focusing on SentinelOne and Splunk integrations.
• Create and modify detection rules, signatures, and alerts across SIEM and EDR platforms (Splunk and SentinelOne) to reduce false positives and enhance fidelity.
• Analyze alerts from Cloud, SIEM, EDR, and XDR tools; build and maintain comprehensive dashboards and perform complex queries to support decision-making.
• Perform vulnerability assessments of discovered CVEs against agency systems and analyze network traffic to provide actionable security recommendations.
• Apply security frameworks such as MITRE ATT&CK and NIST to interpret use cases into actionable monitoring solutions.
• Effectively communicate technical findings to non-technical audiences and influence stakeholders to comply with security standards and best practices.

Cyber Threat Analyst

Engineer

• Design, deploy, and maintain large-scale on-premises and cloud-based Splunk environments to support enterprise monitoring and security alerting.
• Manage knowledge objects (fields, extractions, tags, event types, lookups, macros) and oversee configuration files (.conf and .cfg) across recent Splunk Enterprise versions.
• Analyze and resolve complex data ingestion and parsing issues to ensure accurate data flow and integrity.
• Create and optimize complex Splunk queries (SPL), dashboards, and alerts to support security and operational objectives.
• Develop automation workflows and dashboard interfaces to streamline operations and reduce manual overhead.
• Utilize REST APIs to integrate Splunk with external systems and cloud platforms.
• Collaborate with cross-functional teams (DevOps, Security) and provide mentorship and technical guidance to junior team members.
• Perform upgrades, patching, and performance tuning; participate in off-hours and weekend maintenance efforts as required.

Senior Splunk Engineer

System Administrator

• Own the full lifecycle of Linux-focused patch coordination for real-time devices across development, test, and production environments.
• Plan and execute monthly Linux patch discovery and evaluation cycles, covering kernels, packages, agents, and repository hygiene.
• Coordinate quarterly Linux patch deployments, including scheduling maintenance windows, planning rollbacks, and executing validation steps.
• Drive artifact creation for compliance audits, including patch evidence, change records, test results, deployment logs, and exception documentation.
• Build comprehensive Linux patch test plans and production deployment plans that align with strict client change discipline.
• Partner with platform owners to troubleshoot patch failures, investigate root causes, and reduce recurring deployment defects.
• Create and execute patch runbooks, test plans, and verification checklists to ensure system integrity.

Linux Administrator

SDET

• Oversee the development, integration, and operationalization of SOAR and AI capabilities.
• Serve as the primary subject matter expert for SOAR and AI solutions.
• Design and implement solutions leveraging native SOAR and AI features.
• Expand SOAR and AI adoption to strengthen automated incident response.
• Design and maintain automation tools and dashboards.
• Support multiple security domains with automation tools.
• Proactively manage risk and respond to emerging cyber challenges.
• Develop and maintain security workflows, playbooks, and dashboards.

Senior Security Automation Architect

• Drive identity initiatives, specifically the deployment and optimization of Customer Identity Access Management (CIAM) solutions
• Define and track "metrics-that-matter" to evaluate the health and success of identity platforms
• Manage technical implementations related to Identity tools, including Ping, Okta, Entra, SailPoint, and BeyondTrust
• Utilize AI/ML-based tools and techniques to detect anomalies and fraudulent activity
• Leverage Artificial Intelligence and Machine Learning to improve user authentication in a large-scale enterprise context
• Improve data quality through the application of AI/ML and advanced analytics
• Provide executive briefings and manage stakeholder expectations through effective storytelling with data
• Collaborate across Operations to provide SOC enhancement capabilities
• Identify cybersecurity problems requiring mitigating controls
• Stay current on cybersecurity trends and AI/ML research

Identity Security Lead

Analyst

• Execute Windows Server upgrades (in-place and migration-based) following approved implementation and rollback plans
• Perform Windows OS security patching aligned to maintenance schedules and vulnerability remediation targets
• Support NERC CIP compliance by following required procedures and preserving audit evidence
• Coordinate planned outages with operations, cybersecurity, application, and infrastructure teams
• Create and execute change requests in accordance with formal change management processes
• Perform post-maintenance validation (system health, services, logs, application availability)
• Produce detailed documentation for all activities to ensure audit readiness and traceability
• Track, escalate, and support resolution of issues encountered during upgrade and patch cycles

Junior Windows Analyst

Data Engineer

• Manage and develop security data pipelines.
• Ensure reliable and efficient data movement and transformation.
• Support pipeline development and administration.
• Integrate across SIEM, EDR, and other platforms.
• Assist system owners to achieve logging and monitoring objectives.
• Create and maintain deployment and data pipelines documentation.
• Support security analytics capabilities expansion.
• Collaborate with stakeholders to optimize data processes.