Job description

Deloitte’s Government & Public Services practice is seeking a Project Security Engineer III, for our Cyber -Enterprise Security team to support clients in strengthening and scaling cybersecurity capabilities across complex environments. This role focuses on helping organizations design, implement, and improve enterprise security solutions that align to business and mission needs. The ideal candidate brings experience supporting security engineering, control implementation, and cross-functional delivery in dynamic client settings. Our Deloitte Cyber team understands the unique challenges and opportunities businesses face in cybersecurity. Join our team to deliver powerful solutions to help our clients navigate the ever-changing threat landscape. Through powerful solutions and managed services that simplify complexity, we enable our clients to operate with resilience, grow with confidence, and proactively manage to secure success. Recruiting for this role ends on 12/01/2026. Work You’ll Do As a Security Data Engineer, on the Enterprise Security team, you will be responsible for: • Design, write, and deploy high-fidelity detection rules using SQL, Sigma, YARA-L, or Python targeting network-based attack techniques (e.g., C2 beaconing, data exfiltration, and lateral movement). • Continuously tune network detections to reduce false-positive rates while maintaining a high signal-to-noise ratio. • Identify telemetry required to support network monitoring, threat hunting, incident response, and custom detection engineering. • Map detection requirements to underlying data sources and identify visibility gaps across hybrid cloud and on-premises environments • Design and maintain pipelines that ingest security telemetry from network, endpoint, identity, cloud, application, OT, and security infrastructure. • Ensure telemetry is delivered reliably to SIEM, data lake, analytics, and detection platforms; troubleshoot ingestion, parsing, latency, and data-quality issues. • Evaluate whether packet, flow, session, DNS, proxy, authentication, endpoint, and application telemetry is sufficient for specific detection requirements. • Support custom detection development through data discovery, enrichment, normalization, and validation. • Identify opportunities to move detections from low-level indicators toward higher-level behavioral and tradecraft-based detection using the Detection Stack. • Work with network engineering teams to evaluate technologies such as network sensors, NetFlow/IPFIX, DNS telemetry, proxy telemetry, firewall logs, IDS/IPS, packet capture, Zeek/network metadata, and NDR platforms. • Establish telemetry health metrics, dashboards, and automated checks for missing, delayed, or malformed data. • Assess network visibility across data centers, cloud environments, remote networks, and segmented environments. • Optimize telemetry architectures and ingestion pipelines for performance, scalability, reliability, and cost A successful candidate would possess these skills: • Ability to work independently and collaborate as part of a team • Effective written and verbal communication skills • Meticulous attention to detail and quality of work product • Ability to build and sustain professional relationships • Ability to lead projects or workstreams • Ability to manage and prioritize multiple tasks in a fast-paced and dynamic environment • Strong technical acumen • Strong interpersonal skills and professional demeanor • Ability to meet deadlines • Ability to provide clear guidance to others The Team Deloitte’s Government & Public Services (GPS) practice – our people, ideas, technology and outcomes – is designed for impact. Serving federal, state, & local government clients as well as public higher education institutions, our team of professionals brings fresh perspective to help clients anticipate disruption, reimagine the possible, and fulfill their mission promise. Our Enterprise Security offering embeds security in all aspects of digital transformation by securing a client’s technical backbone while enabling secure digital transformation. Includes security architecture, secure development and deployment, end-to-end cyber cloud capabilities, application security, and security for emerging technologies and connected products. The Project Delivery Talent Model is designed for professionals with specialized skills that align to a current client need. Team members focus on delivering services to clients, without additional expectations related to business development or promotion. Their employment is tied to their role on a project, and they are eligible for a benefits package that is competitive for project delivery-focused professionals. Qualifications Required : • Bachelor’s degree in Cybersecurity or Information Technology. • Active TS/SCI or SCI eligibility. • 4+ years of experience in cybersecurity, enterprise security, or information security • 3+ years of experience supporting the implementation or administration of security technologies across enterprise environments • 3+ years of experience producing technical documentation, status reporting, or client deliverables for security engagements Preferred: • Master's degree in Cybersecurity, Information Technology, Information Systems, Engineering or related field with 10+ years of related experience. • Experience supporting government or public sector clients • Experience with cloud security, data security, and network security For individuals assigned and/or hired to work in Colorado, Deloitte is required by law to include a reasonable estimate of the compensation range for this role. This compensation range is specific to Colorado and takes into account the wide range of factors that are considered in making compensation decisions including but not limited to skill sets; experience and training; and other business and organizational needs. At Deloitte, it is not typical for an individual to be hired at or near the top of the range for their role and compensation decisions are dependent on the facts and circumstances of each case. A reasonable estimate of the current range is $95,600 to $159,300. You may also be eligible to participate in a discretionary annual incentive program, subject to the rules governing the program, whereby an award, if any, depends on various factors, including, without limitation, individual and organizational performance.

Requirements

Must-haves

Recruiting for this role ends on 12/01/2026.
Work You’ll Do
Continuously tune network detections to reduce false-positive rates while maintaining a high signal-to-noise ratio.
Identify telemetry required to support network monitoring, threat hunting, incident response, and custom detection engineering.
Map detection requirements to underlying data sources and identify visibility gaps across hybrid cloud and on-premises environments
Design and maintain pipelines that ingest security telemetry from network, endpoint, identity, cloud, application, OT, and security infrastructure.
Ensure telemetry is delivered reliably to SIEM, data lake, analytics, and detection platforms; troubleshoot ingestion, parsing, latency, and data-quality issues.
Evaluate whether packet, flow, session, DNS, proxy, authentication, endpoint, and application telemetry is sufficient for specific detection requirements.
Support custom detection development through data discovery, enrichment, normalization, and validation.
Identify opportunities to move detections from low-level indicators toward higher-level behavioral and tradecraft-based detection using the Detection Stack.
Work with network engineering teams to evaluate technologies such as network sensors, NetFlow/IPFIX, DNS telemetry, proxy telemetry, firewall logs, IDS/IPS, packet capture, Zeek/network metadata, and NDR platforms.
Establish telemetry health metrics, dashboards, and automated checks for missing, delayed, or malformed data.
Assess network visibility across data centers, cloud environments, remote networks, and segmented environments.
Optimize telemetry architectures and ingestion pipelines for performance, scalability, reliability, and cost A successful candidate would possess these skills:
Ability to work independently and collaborate as part of a team
Effective written and verbal communication skills
Meticulous attention to detail and quality of work product
Ability to build and sustain professional relationships
Ability to lead projects or workstreams
Ability to manage and prioritize multiple tasks in a fast-paced and dynamic environment
Strong technical acumen
Strong interpersonal skills and professional demeanor

Nice-to-haves

Experience supporting government or public sector clients
Experience with cloud security, data security, and network security

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

sqlpython

Platform: avature
Effort: medium