{"id":4220092,"url":"https://alion.io/job/general-dynamics-information-technology-cybersecurity-infrastructure-lead","title":"Cybersecurity Infrastructure - Lead","company":{"id":4418,"name":"General Dynamics Information Technology","domain":"gdit.com","url":"https://alion.io/company/gdit","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":95,"open_postings":51,"ghost_share":0,"stale_share":0.176,"repost_share":0.059,"time_to_fill_p50_days":37,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Tampa, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":144500,"max":195500,"currency":"USD","period":"year","gross":null,"usd_annual":195500},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Bash","optional":false},{"name":"Debian","optional":false},{"name":"Defense in Depth","optional":false},{"name":"Linux","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"Security Onion","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Suricata","optional":false},{"name":"TCP/IP","optional":false},{"name":"Ubuntu","optional":false},{"name":"Zeek","optional":false},{"name":"Wireshark","optional":true}],"status":"live","first_seen_at":"2026-11-12T00:00:00Z","employer_posted_date":"2026-11-12","last_verified_at":"2026-11-13T04:20:14Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Type of Requisition:\nRegularClearance Level Must Currently Possess:\nTop Secret/SCIClearance Level Must Be Able to Obtain:\nTop Secret/SCIPublic Trust/Other Required:\nNoneJob Family:\nCyber and IT Risk ManagementJob Qualifications:\nSkills:\nCloud Based Solutions, Critical Infrastructure Security, Firewall SecurityCertifications:\nNoneExperience:\n5 + years of related experienceUS Citizenship Required:\nYesJob Description:\nTransform technology into opportunity as a Cybersecurity Infrastructure - Lead with GDIT. A career in enterprise IT means connecting and enhancing the systems that matter most. At GDIT you’ll be at the forefront of innovation and play a meaningful part in improving how agencies operate.\nAt GDIT, people are our differentiators. As a Cybersecurity Infrastructure - Lead, you will help ensure today is safe and tomorrow is smarter. Our work depends on a Cybersecurity Systems Administrator - Lead joining our team to provide cyber technical support for the Cyber Security Operations Center (CSOC).\nHOW A CYBERSECURITY INFRASTRUCTURE LEAD WILL MAKE AN IMPACT\nSupport will consist of configuring, tuning, optimizing, and maintaining critical security infrastructure to safeguard the organization's digital assets against evolving cyber threats.\nYou'll be responsible for overseeing the operation, architecture alignment, and maintenance of essential cybersecurity systems, including:\nEnterprise Firewalls and boundary protection controls\nCloud-based Internet Isolation (CBII) / Remote Browser Isolation (RBI) platforms\nNetwork Intrusion Detection/Prevention Systems (IDS/IPS) built on Security Onion (Suricata, Zeek)\nNetwork packet brokers and visibility fabric using Gigamon TAPs\nSecurity Information and Event Management (SIEM) technologies (Splunk)\nEndpoint Detection & Response (EDR) systems\nNetwork Access Control (NAC) policies\nSecurity Orchestration, Automation, and Response (SOAR) platforms\nWHAT YOU’LL NEED TO SUCCEED:\nEducation: Bachelor’s degree in Information Systems, Computer Science, Computer Engineering, Cybersecurity, or another related field. Relevant work experience may be considered in lieu of a degree.\n Certification(s): Applicable DoD 8140 or DoD 8570 Certification (e.g., Security+ CE, CySA+, CASP+, CISSP, or relevant CSSP role certifications).\n Required Experience: 5+ years of experience in cybersecurity infrastructure administration and engineering, with hands-on focus in:Configuring and managing next-generation firewalls (NGFW) and boundary security policies.\nAdministering Cloud-based Internet Isolation (CBII) and web proxy solutions.\nDeploying, tuning, and operating IDS/IPS sensors via Security Onion and managing network visibility fabrics using Gigamon hardware/virtual TAPs.\nConfiguring and managing SIEM, EDR, NAC, and SOAR platforms.\n\nSecurity Clearance Level: TS/SCI\nLocation: On-site in Tampa, FL\nCitizenship: U.S. Citizenship Required\nREQUIRED TECHNICAL SKILLS:\n Operating Systems & Scripting: Proficiency in Linux environments (RHEL, Ubuntu/Debian), including system administration, package management, and shell scripting (Bash, Python) for automation and log pipeline customization.\n Network Security & Visibility:Deep understanding of TCP/IP networking, packet analysis, traffic aggregation, filtering, and flow distribution using packet brokers and TAP infrastructure.\nHands-on expertise managing and tuning Security Onion architecture, including Suricata signature tuning, Zeek network analysis, and sensor deployment.\nRobust knowledge of Next-Generation Firewalls (NGFW) rule base management, NAT policies, SSL/TLS inspection, and perimeter access controls.\nExperience administering Cloud-Based Internet Isolation (CBII) or Secure Web Gateways (SWG) to safeguard users from web-borne threats.\n\nThreat Landscapes & Tuning: Solid understanding of cybersecurity principles, MITRE ATT&CK framework, threat vectors, and detection engineering best practices across perimeter, network, and endpoint tools.\nAnalytical & Troubleshooting: Strong analytical skills with the ability to troubleshoot complex packet drop, network routing, sensor capture, and tool pipeline performance issues.\nProfessional Attributes: Excellent communication and collaboration skills; demonstrated ability to work independently, prioritize high-impact operational tasks, and meet critical deliverables in a dynamic CSOC environment.\nREQUIRED SKILLS AND ABILITIES:\n1. Configuration and Optimization\nFirewalls & Perimeter Defense: Manage, configure, and audit enterprise firewall rule sets, ensure defense-in-depth posture, and enforce strict ingress/egress filtering policies.\n Cloud-Based Internet Isolation (CBII): Administer and optimize CBII policies, ensuring seamless secure web browsing, policy enforcement, and isolation of high-risk external web sessions.\nNetwork IDS/IPS & TAPs:Deploy, manage, and scale Gigamon TAPs and network packet broker fabrics to aggregate, filter, de-duplicate, and route high-throughput network traffic efficiently to inspection tools.\nDeploy and maintain Security Onion sensor grids across multiple security enclaves; optimize Suricata IDS/IPS detection rulesets and Zeek protocol parsing scripts to minimize false positives and maximize threat visibility.\n\n SIEM, EDR & NAC:Deploy, configure, and maintain clustered SIEM (Splunk) environments, search queries, dashboards, and correlation alerts.\nFine-tune EDR policies, sensor configurations, and scanning parameters to maintain comprehensive host visibility.\nConfigure and enforce Network Access Control (NAC) policies to mitigate unauthorized device connectivity.\n\nData Integration: Ingest and normalize logs from firewalls, Gigamon metadata, Security Onion alerts, CBII telemetry, and endpoint sensors into SIEM and central monitoring stacks.\n2. Maintenance and Support\nPerform routine preventative maintenance, software upgrades, firmware updates, OS patching, and performance tuning across firewalls, Gigamon appliances, Security Onion sensors, and central management servers.\nMonitor traffic throughput, tap drop rates, sensor health, and resource utilization across network security appliances to guarantee continuous, zero-blind-spot visibility.\nProvide tiered escalation support and troubleshooting for operational incidents affecting boundary protections, isolation sessions, or sensor pipelines, coordinating with hardware and software vendors as required.\nPerform regular system audits and vulnerability assessments of security tools, implementing corrective remediation actions and hardening benchmarks (e.g., DISA STIGs).\nPrepare technical briefings and operational capability demonstrations for CSOC and program leadership.\n3. Policy Development, Integration, and Compliance\nDevelop, document, and enforce standard operating procedures (SOPs), configuration baselines, and security policies governing firewalls, sensor tap points, and isolated browser workflows in accordance with DoD and agency guidelines.\nCollaborate with audit and compliance teams to ensure boundary defenses, network monitoring tools, and log retention satisfy FISMA/DoD compliance mandates and RMF controls.\nIntegrate network detection platforms (Security Onion, Firewalls) with the SOAR environment to trigger automated enrichment, dynamic IP blocking, and rapid containment workflows.\nDesign, implement, and maintain custom SOAR playbooks that accelerate CSOC triage for high-fidelity alerts generated by boundary and IDS appliances.\n4. Training and Knowledge Sharing\nAuthor and maintain engineering documentation, network architecture diagrams, and operational runbooks for firewall rules, Gigamon map configurations, and Security Onion deployments.\nProvide training and technical mentoring to CSOC Tier 1/2 analysts on querying network metadata (Zeek), evaluating IDS alerts (Suricata), and interpreting isolation session telemetry.\nFoster cross-functional collaboration and knowledge-sharing within the cybersecurity engineering team.\nPREFERRED SKILLS:\nPrior CENTCOM / Combatant Command (COCOM) operational environment experience.\nVendor-specific certifications (e.g., Gigamon Certified Professional, Palo Alto PCNSE / Fortinet NSE, Security Onion training).\nSplunk Enterprise Certified Admin or Power User certification.\nPractical background in Threat Hunting, Network Traffic Analysis (PCAP analysis, Wireshark), or CSOC analyst roles.\nDeep experience in hardening systems against DISA STIGs within DoD TS/SCI enclaves.\nGDIT IS YOUR PLACE:\n401(k) with company match\nComprehensive health and wellness packages\nInternal mobility team dedicated to helping you own your career\nProfessional growth opportunities including paid education and certifications\nCutting-edge technology you can learn from\nRest and recharge with paid vacation and holidays\nThe likely salary range for this position is $144,500 - $195,500. This is not, however, a guarantee of compensation or salary. Rather, salary will be set based on experience, geographic location and possibly contractual requirements and could fall outside of this range.\nScheduled Weekly Hours:\n40Travel Required:\nLess than 10%Telecommuting Options:\nOnsiteWork Location:\nUSA FL MacDill AFBAdditional Work Locations:\nTotal Rewards at GDIT:\nOur benefits package for all US-based employees includes a variety of medical plan options, some with Health Savings Accounts, dental plan options, a vision plan, and a 401(k) plan offering the ability to contribute both pre and post-tax dollars up to the IRS annual limits and receive a company match. To encourage work/life balance, GDIT offers employees full flex work weeks where possible and a variety of paid time off plans, including vacation, sick and personal time, holidays, paid parental, military, bereavement and jury duty leave. To ensure our employees are able to protect their income, other offerings such as short and long-term disability benefits, life, accidental death and dismemberment, personal accident, critical illness and business travel and accident insurance are provided or available. We regularly review our Total Rewards package to ensure our offerings are competitive and reflect what our employees have told us they value most.Our Identity Verification Process:\nAs part of the hiring process, we will ask you to complete an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud. You are expected to be on camera during virtual interviews. We reserve the right to take your picture to verify your identity and prevent fraud. By proceeding, you authorize the collection, processing, and use of your biometric data for identity verification and security purposes.About Our Work:\nWe are GDIT. A global technology and professional services company that delivers technology solutions and mission services to every major agency across the U.S. government, defense and intelligence community. Our 26,000 experts extract the power of technology to create immediate value and deliver solutions at the edge of innovation. We operate across 50+ countries worldwide, offering leading mission-ready capabilities in AI, cloud, cyber and software development.Join our Talent Community to stay up to date on our career opportunities and events atgdit.com/tc.\nEqual Opportunity Employer / Individuals with Disabilities / Protected Veterans","description_format":"text","description_chars":11355,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[]},"benefits":["Growth opportunities"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Network Security","National Security"],"lifecycle":[{"event":"open","at":"2026-11-13T04:20:14Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":14,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 21 · green card filings: 4","filings_12m":21,"filings_prev_12m":30,"green_card_filings_12m":4,"median_offered_wage_usd":154900,"route":null,"cap_exempt":false,"checked_at":"2026-11-12T07:36:15+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)","Alion: sponsorship offered in the employer's own job adverts (24 months)"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":37,"reasons":["conf:2","win:early","comp:brand"],"computed_at":"2026-11-13T07:08:42Z"},"pay":{"stated_usd_annual":195500,"is_top_pay":false},"html_url":"https://alion.io/job/general-dynamics-information-technology-cybersecurity-infrastructure-lead","json_url":"https://alion.io/job/general-dynamics-information-technology-cybersecurity-infrastructure-lead.json","meta":{"generated_at":"2026-11-13T07:08:42Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14940,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4418},"rest":"https://alion.io/mcp/rest/get_company?id=4418"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fgeneral-dynamics-information-technology-cybersecurity-infrastructure-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fgeneral-dynamics-information-technology-cybersecurity-infrastructure-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fgeneral-dynamics-information-technology-cybersecurity-infrastructure-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/general-dynamics-information-technology-cybersecurity-infrastructure-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fgeneral-dynamics-information-technology-cybersecurity-infrastructure-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4220092}},{"tool":"search_jobs","arguments":{"company":"gdit.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4220092},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}