EY Government Public Sector - Cybersecurity 

United States, Virginia, Arlington 

722126595

Your key responsibilities

As part of our Blue Team, you will focus on proactive cyber defense, threat detection, security monitoring, and intelligence-driven defense to protect enterprise environments. Your work will include real-time security event analysis, security automation, incident response support, forensic investigations, and adversary simulation collaboration with Red and Purple Teams. You will also leverage cyber threat intelligence (CTI) to improve detection engineering, threat hunting methodologies, and defense strategies.

Our professionals work together in planning, executing, and managing engagements to assess, improve, build, and, in some cases, operate integrated security operations for our clients.

Skills and attributes for success

• Conduct real-time security monitoring, log analysis, and threat detection using SIEM tools such as Splunk, Elastic, Microsoft Sentinel, CrowdStrike NG-SIEM, and Palo Alto Cortex.
• Perform threat hunting and anomaly detection by analyzing security event data and network traffic for malicious activity.
• Integrate cyber threat intelligence (CTI) into detection methodologies, correlating indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) to strengthen defenses.
• Respond to cybersecurity incidents, conduct forensic investigations, and provide mitigation recommendations.
• Develop and fine-tune detection rules, alerts, and use cases for monitoring tools to improve incident detection and response.
• Conduct malware analysis, reverse engineering, and threat intelligence correlation to improve defensive strategies.
• Work closely with Red and Purple Teams to simulate adversary tactics, improve detection efficacy, and test security defenses in adversary emulation exercises.
• Provide guidance on security best practices, hardening techniques, and zero-trust architectures.
• Automate security operations and develop playbooks using SOAR platforms to improve response efficiency.
• Conduct security assessments and assist with compliance efforts for industry standards such as MITRE ATT&CK, NIST 800-53, ISO 27001, and CIS Benchmarks.

To qualify for the role you must have

• Bachelor’s degree in Computer Science, Information Systems, Engineering, Business, or a related field, and a minimum of 5 years of related work experience; or a Master’s degree and 4 years of related work experience in security operations, threat detection, or incident response.
• Any one or more of the following certifications:
  • CISSP (Certified Information Systems Security Professional)
  • CISM (Certified Information Security Manager)
  • CISA (Certified Information Systems Auditor)
  • OSCP (Offensive Security Certified Professional)
  • SANS GIAC certifications, such as:
    • GSE (GIAC Security Expert)
    • GCFA (Forensic Analyst)
    • GNFA (Network Forensic Analyst)
    • GDAT (Defending Advanced Threats)
    • GMON (Continuous Monitoring and Security Operations)
    • GCIH (Incident Handler)
    • GREM (Reverse Engineering Malware)
    • GSOC (Security Operations Center)
    • GCIA (Intrusion Analyst)
    • GCED (Enterprise Defender)
• Hands-on experience with SIEM, SOAR, EDR, NDR, email security and security monitoring platforms.
• Strong understanding of network security, cloud security (AWS, Azure, GCP), and endpoint protection strategies.
• Experience with log analysis, network traffic analysis, and behavioral analytics for identifying suspicious activity.
• Strong scripting and automation skills in Python, PowerShell, or Bash to streamline security operations.
• Experience with MITRE ATT&CK framework, adversary emulation, and threat intelligence integration.
• Must have an active TS/SCI clearance with eligibility for a polygraph and be able to maintain it.
• Must be willing to work on-site as needed by the client in the greater Washington, DC area

Ideally, you'll also have

Prior consulting experience.

• Experience developing custom threat detection analytics and behavioral anomaly detection rules.
• Familiarity with cloud-native security monitoring tools (AWS GuardDuty, Azure Security Center, Google Chronicle).
• Experience with deception technologies, honeypots, and adversary engagement techniques.
• Deep understanding of Active Directory security, Kerberos attacks, and lateral movement techniques.
• Experience working in Cloud/Container environments.
• Penetration Testing experience.
• Application Security experience.
• Attack Surface Management experience.

What we offer

We offer a competitive compensation package where you’ll be rewarded based on your performance and recognized for the value you bring to our business. In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options. Under our flexible vacation policy, you’ll decide how much vacation time you need based on your own personal circumstances. You’ll also be granted time off for designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being.

• Continuous learning: You’ll develop the mindset and skills to navigate whatever comes next.
• Success as defined by you: We’ll provide the tools and flexibility, so you can make a meaningful impact, your way.
• Transformative leadership: We’ll give you the insights, coaching and confidence to be the leader the world needs.

• Continuous learning: You’ll develop the mindset and skills to navigate whatever comes next.
• Success as defined by you: We’ll provide the tools and flexibility, so you can make a meaningful impact, your way.
• Transformative leadership: We’ll give you the insights, coaching and confidence to be the leader the world needs.
• Diverse and inclusive culture: You’ll be embraced for who you are and empowered to use your voice to help others find theirs.