Darktrace Engineer - Secret | Washington, DC

Optiv + ClearShark is looking for a Darktrace Cybersecurity Engineer is responsible for the design, deployment, configuration, integration, tuning, and operational support of Darktrace Cyber AI capabilities across enterprise networks, endpoints, email, cloud, SaaS, identity, and other supported environments.

The engineer will work closely with security operations, network engineering, cloud engineering, identity, incident response, and customer stakeholders to improve threat detection, investigation, and response.

This position requires a technically strong cybersecurity professional with experience in network detection and response, security monitoring, incident triage, packet and log analysis, security-tool integration, and operational security engineering.

The successful candidate will be comfortable working in regulated or federal environments and will translate Darktrace detections, behavioral analytics, and AI-assisted investigations into actionable security outcomes.

Darktrace capabilities may encompass network, endpoint, email, cloud, SaaS, and identity telemetry, with AI-assisted investigation workflows and integrations to SIEM, SOAR, EDR/XDR, cloud, and log-management technologies.

How you’ll make an impact

• Design, deploy, configure, administer, and maintain Darktrace platform components within on-premises, hybrid-cloud, and cloud-hosted enterprise environments.
• Configure and tune Darktrace detections, behavioral models, alerting thresholds, autonomous-response policies, and investigative workflows to align with the organization’s threat model, risk tolerance, architecture, and security operations processes.
• Lead or support implementation of applicable Darktrace capabilities, including network, email, endpoint, cloud, SaaS, and identity-security use cases.
• Perform ongoing platform health checks, capacity planning, sensor or collector placement assessments, system upgrades, configuration validation, and technical troubleshooting.
• Analyze Darktrace model breaches, alerts, anomalies, incident investigations, device behavior, network traffic, and related security telemetry to identify malicious activity, suspicious behavior, false positives, and opportunities for tuning.
• Collaborate with SOC analysts, incident responders, threat hunters, network engineers, cloud teams, system administrators, and identity teams to investigate and contain security events.
• Develop and maintain use cases for threat detection, triage, investigation, enrichment, and escalation across enterprise security domains.
• Configure, test, and maintain integrations between Darktrace and enterprise security technologies, including SIEM, SOAR, EDR/XDR, ticketing, vulnerability-management, threat-intelligence, identity, cloud-security, and log-management platforms.
• Use APIs, syslog, webhooks, automation, and scripting to exchange security events, enrich detections, automate workflows, and support incident-response processes.
• Support security monitoring and incident-response activities by providing deep technical analysis of network, endpoint, email, cloud, SaaS, and identity-related telemetry.
• Develop standard operating procedures, implementation guides, architecture diagrams, operational runbooks, escalation procedures, and knowledge-base articles.
• Produce clear technical reports and briefings that describe detected activity, risk, root cause, response actions, platform health, tuning recommendations, and security trends.
• Participate in security architecture reviews and advise stakeholders on telemetry coverage, sensor placement, segmentation, visibility gaps, logging requirements, and detection strategy.
• Support validation of Darktrace response actions and ensure automated or semi-automated response capabilities are appropriately governed, tested, approved, and documented before production use.
• Maintain awareness of emerging threats, attacker techniques, security-tool capabilities, AI-assisted defense concepts, and relevant MITRE ATT&CK techniques.
• Support compliance and audit activities by maintaining security documentation, evidence, configuration records, operating procedures, and implementation artifacts required for the environment.

What we’re looking for

• Active Secret clearance required at time of hire.
• Bachelor’s degree in cybersecurity, information technology, computer science, engineering, or a related discipline; equivalent combination of education, military training, certifications, and relevant experience may be considered.
• At least 5 years of relevant cybersecurity engineering, security operations, network-security, threat-detection, incident-response, or security-platform administration experience.
• At least 5 years of experience with Darktrace or comparable technologies in one or more of the following categories: Network Detection and Response (NDR), Extended Detection and Response (XDR), Endpoint Detection and Response (EDR), Network Security Monitoring (NSM), Security Information and Event Management (SIEM), User and Entity Behavior Analytics (UEBA), Security Orchestration, Automation, and Response (SOAR)
• Email security, cloud security, or identity-threat detection.
• Demonstrated hands-on experience deploying, configuring, tuning, administering, and troubleshooting Darktrace or similar enterprise cybersecurity platforms.
• Strong knowledge of enterprise networking and network-security concepts, including TCP/IP, OSI model, DNS, DHCP, HTTP/S, SMTP, TLS, VPNs, routing, switching, VLANs, firewalls, proxies, network segmentation, and packet capture/analysis.
• Experience analyzing network traffic, packet captures, security logs, endpoint telemetry, authentication events, and cloud audit data to support incident detection and investigation.
• Experience with security operations processes, including alert triage, investigation, threat hunting, incident escalation, containment, evidence collection, reporting, and post-incident lessons learned.
• Experience integrating security tools with SIEM and SOAR platforms, such as Microsoft Sentinel, Splunk, IBM QRadar, Elastic, ServiceNow, Microsoft Defender, Palo Alto Cortex XSOAR, or similar platforms.
• Working knowledge of API-based integrations, REST APIs, JSON, webhooks, syslog, authentication methods, and log-forwarding concepts.
• Experience with Linux administration and command-line troubleshooting; familiarity with virtual machines, virtualization platforms, and common enterprise operating systems.
• Ability to develop basic automation or integration scripts using Python, PowerShell, Bash, or a comparable scripting language.
• Strong written and verbal communication skills, including the ability to document technical designs, explain investigation findings, and brief technical and nontechnical stakeholders.
• Current Darktrace certification, particularly the Darktrace Cyber Engineer Professional certification or equivalent Darktrace training.
• Experience with Darktrace / NETWORK, / EMAIL, / ENDPOINT, / CLOUD, and / IDENTITY; Cyber AI Analyst investigations; Threat Visualizer; and autonomous-response capabilities and policy governance.
• Experience with Microsoft security technologies, including Microsoft Defender XDR, Microsoft Defender for Endpoint, Defender for Office 365, Entra ID, Microsoft Sentinel, Azure, and Microsoft 365.
• Experience with cloud-security monitoring and engineering in AWS, Azure, Azure Government, AWS GovCloud, Google Cloud Platform, or hybrid-cloud environments.
• Familiarity with identity-security technologies and authentication telemetry, including Active Directory, Microsoft Entra ID, privileged access management, SSO, MFA, federation, conditional access, and identity threat detection.
• Experience working in Department of Defense, intelligence community, federal civilian, defense-industrial-base, or other regulated environments.
• Knowledge of NIST RMF, NIST SP 800-53, NIST SP 800-171, NIST Cybersecurity Framework, DoD STIGs, CMMC, FedRAMP, F