Why Center for Internet Security
FY2025 · Form 990Its mission and biggest programs, as filedProtects organizations from cyber threats.
- Security best practices combines both the Security benchmarks and critical Security controls programs. The Security benchmarks program helps organizations improve their IT Security posture by reducing risks resulting from inadequate technical Security controls. To accomplish this, the Security benchmarks program…$40.2M spent in FY2025
- The cis services program offers services to all state, local, territorial, and tribal entities and public authorities to improve their overall cyber and election Security. These services include scanning, Security assessments, phishing exercises, and other cyber Security related services.$31.9M spent in FY2025
- The ms-isac program provides a common mechanism for raising the level of cybersecurity readiness and response in each state and with local governments and u.s. Tribes and territories with the goal of improving the overall cybersecurity posture of u.s. State…$13.5M spent in FY2025
Before you apply
FY2024 · Form 990Independent: from IRS data, not the orgAbout the role
The org's own posting, as writtenThe Principal SIEM Engineer is part of the Operations, Intelligence and Services (OIS) department, which resides on the Engineering team and reports to the Senior Director, Operations, Intelligence and Services. This is a senior, hands-on individual contributor role on the SIEM and SOAR Engineering team. As our Principal SIEM Engineer, you will build and run the platform CIS’s Security Operations Center (SOC) works in: SIEM configuration and log source onboarding, SOAR case management and playbook automation, detection content, and troubleshooting of the ingestion and case creation pipeline from the collector through to the case an analyst opens.
This role requires hands-on engineering in our SIEM and SOAR platform day to day. This role is also the terminal technical escalation point for the platform, which means owning a problem through to resolution rather than routing it onward, including holding the vendor accountable when the defect originates on their side. CIS provides support to U.S. State, Local, Tribal, and Territorial (SLTT) organizations through a set of cybersecurity solutions (IDS, PDNS, endpoint, and Managed Detection and Response) that feed data to CIS’s SOC, including support for organizations we define as underserved, those with very limited resources that are not well served by current commercial providers.
Those services keep growing in both volume and variety. Every managed service customer arrives with log sources that must be collected, parsed, tagged, validated, alerted on, and automated before the SOC can work them, and much of that is built per log source rather than once per customer. The person in this role must be able to carry a problem across the whole pipeline rather than hand it to a specialist.
What You'll Do
Develop and maintain SOAR content in our platform, including case management configuration, escalation playbooks, and automations.
Author and version playbook templates, including bulk escalation templates spanning multiple source types such as CrowdStrike and Albert, and coordinate changes with SOC leadership before deploying them Configure and maintain the SIEM, including relay build and join to the SIEM, log source tagging, regular expressions, parsing validation, and alert definitions Build and tune detection content across the sources CIS monitors, including Suricata, CrowdStrike, and Albert, along with third party endpoint, firewall, and network telemetry Troubleshoot the ingestion and case creation pipeline end to end and serve as the tier 2 escalation point for the platform; covering every ingestion failure, playbook logic errors, data variance between third party portals and SOAR case data, and any undocumented error type, owned through to resolution Participate in incident response for the platform, including the tier 2 after-hours on call rotation, and maintain the alerting and routing behind it Manage technical escalation with the SIEM and SOAR vendor as the CIS contact on severity cases…
About Center for Internet Security
From its Form 990- Budget $126.3M · Public & Societal Benefit
- Staff 542 · founded 2000
- Pays its leaders $320K–$1.2M (12 reported)
- Open jobs 7 · Jobs at Center for Internet Security · Full 990 report