Automation, Reporting, & Content Development Engineer

About the role

Drive the SOC's analytics lifecycle—detections, dashboards, KPIs, metrics, automation, correlation, and TTP documentation—to convert signals into insight and insight into action.

Responsibilities

• Build detection analytics, dashboards, trend and KPI reporting (MTTD/MTTR, resolution and false-positive rates).
• Automate enrichment/reporting; perform incident correlation and attack-lifecycle visualization.
• Document TTPs; prioritize countermeasures and produce executive recommendations.

Requirements

• 3-5 years in threat analytics/SOC content; NetFlow/log analysis; scripting/data visualization.
• Experience across SIEM/EDR/DLP/cloud telemetry and BI/reporting tools.
• Security clearance: Ability to obtain/maintain a Public Trust (or higher per client).
• US Citizenship or Green Card Required, with eligibility to obtain a public trust clearance.

Qualifications

• Bachelor's; GCTI or equivalent helpful.

Skills

• Competitive compensation
• Comprehensive insurance options
• Matching contributions through the 401(k) plan and the share purchase plan
• Paid time off for vacation, holidays, and sick time
• Paid parental leave
• Learning opportunities and tuition assistance
• Wellness and Well-being programs

Benefits

• Reasonable accommodations to qualified individuals with disabilities.
• Dependent upon role and/or federal government security clearance requirements, and in accordance with applicable laws, some background investigations may include a credit check.
• CGI will consider for employment qualified applicants with arrests and conviction records in accordance with all local regulations and ordinances.

Pay

A reasonable estimate of the current range for this role in the U.S. is $63,700.00 - $139,300.00.

Schedule

This position is located in our Knoxville, TN office; however, a hybrid working model is acceptable.