Cybersecurity Engineer / Software Developer III (Penetration Testing & SIEM Integration)

Job Role: Cybersecurity Engineer / Software Developer III (Penetration Testing & SIEM Integration)

Must be on-site in Austin, TX – Local candidates only

Position Overview
We are seeking an experienced Cybersecurity Engineer / Software Developer III to support HHSC’s Chief Information Security Office (CISO). This role focuses on designing, developing, and supporting cybersecurity engineering solutions that enhance penetration testing capabilities, security automation, and SIEM integrations.

The ideal candidate will have strong software development expertise combined with hands-on cybersecurity engineering experience, including Kali Linux infrastructure, custom scripting, secure API development, and security data pipeline integrations supporting Splunk and enterprise monitoring platforms.

This role directly supports Zero Trust initiatives, continuous monitoring, and enterprise security modernization efforts.

Responsibilities
(Including but not limited to)
Security Engineering & Development
• Design and develop secure APIs, microservices, and automation solutions supporting penetration testing workflows.
• Build integrations between penetration testing tools, vulnerability scanners, and enterprise SIEM platforms.
• Develop and maintain security data ingestion pipelines to normalize and forward telemetry into Splunk and other SIEM systems.
• Create automation scripts to orchestrate testing, evidence collection, and reporting processes.
• Integrate security testing results with GRC platforms and compliance frameworks.

Penetration Testing Enablement
• Build and maintain Kali Linux-based penetration testing infrastructure (virtualized and cloud-hosted environments).
• Configure and manage penetration testing toolchains and supporting frameworks.
• Develop custom exploit scripts and proof-of-concept code to validate vulnerabilities.
• Support red team and application penetration testing engagements through automation and tooling enhancements.

SIEM & Security Operations Integration
• Develop APIs and connectors to integrate security tools with Splunk or other SIEM platforms.
• Implement log parsing, normalization, and enrichment processes to improve detection accuracy.
• Automate alert enrichment, correlation, and reporting workflows.
• Collaborate with CSOC teams to align detection and monitoring strategies.

Scripting & Automation
• Develop automation using Python, Bash, PowerShell, or similar languages.
• Implement CI/CD pipelines for security tools and integration code.
• Maintain version control repositories and documentation.

Security & Compliance Alignment
• Ensure solutions comply with HHSC security standards, DIR requirements, and NIST frameworks.
• Participate in architecture reviews and risk assessments.
• Produce technical documentation, configuration guides, and operational runbooks.

Required Qualifications
• Bachelor’s degree in Computer Science, Information Technology, or related field (or equivalent experience).
• 8+ years of experience building security automation solutions and platform integrations.
• 8+ years of hands-on experience with penetration testing tools and Kali Linux environments.
• Strong scripting experience (Python, Bash, PowerShell).
• Experience developing secure APIs and integrating enterprise platforms.
• Experience integrating security telemetry into SIEM platforms (Splunk, Sentinel, or similar).
• Experience administering Linux systems.
• Knowledge of secure coding practices and cybersecurity fundamentals.
• Ability to work independently on complex initiatives with minimal supervision.

Preferred Qualifications
• 3+ years developing REST APIs using Python, Java, JavaScript, or C#.
• Experience building security data pipelines and SIEM integrations (Splunk preferred).
• Experience designing scalable security tool architectures using containerization or virtualization (Docker, VMware, cloud labs).
• Experience working in government or regulated environments (HHS agency experience preferred).
• Experience implementing CI/CD pipelines for security automation.

Preferred Certifications
• OSCP, CEH, or equivalent penetration testing certification.
• Splunk Certified Developer or SIEM certification.
• Security+, CISSP, or equivalent.
• Linux administration certification.