Cybersecurity Integration Engineer | ACS/OEM Integration, SIEM Detection & Deployment Packaging

Cybersecurity Integration Engineer — ACS Lab Integration, Detection Engineering & Deployment Packaging Project Objective Guard Hawk is seeking an experienced cybersecurity integration engineer to establish and validate an end-to-end integration between one physical access control system (ACS) OEM product and the Guard Hawk Command Platform (GHCP) in an isolated, non-production lab environment. The engagement will establish a working ACS lab deployment, collect genuine OEM-generated security telemetry, implement normalized detection capabilities, and deliver a reusable integration package suitable for future production deployment preparation. The goal is to establish a repeatable technical foundation for integrating additional physical security products without rebuilding detection logic from scratch. Core Deliverables 1. OEM Selection and Feasibility Assessment * Evaluate available ACS products for lab installation, licensing, telemetry accessibility, and integration feasibility. * Identify hardware, software, licensing, and API/SDK requirements. * Recommend one OEM product and a supported telemetry collection method for implementation. * Obtain Guard Hawk approval before committing to product-specific implementation. 2. ACS Lab Installation and Configuration * Install and configure the selected ACS software in an isolated lab environment, subject to OEM licensing and technical requirements. * Configure representative test identities, credentials, access permissions, and door/controller objects. * Establish the ability to generate genuine OEM events. * Document installation requirements, configuration, and limitations. 3. Telemetry Collection and Normalization * Implement supported collection through OEM APIs, SDKs, syslog, or another approved method. * Preserve original source events. * Develop a lightweight common event schema and documented OEM-specific field mappings. * Identify missing fields and limitations affecting detection compatibility. 4. Detection Engineering * Implement and validate three security-relevant scenarios: * Access privilege modification. * Repeated or suspicious denied access. * ACS controller or communication health disruption. * Associate detections with MITRE ATT&CK Enterprise or ICS techniques where technically defensible. * Provide investigation context and recommended remediation guidance. 5. End-to-End Validation * Demonstrate the complete workflow from genuine OEM event generation through GHCP collection, normalization, detection, and dashboard alerting. * Deliver repeatable test cases with expected and observed results. * Document false-positive considerations, event coverage, and technical limitations. 6. Reusable Integration Package * Deliver version-controlled collection configurations, parsers, normalization mappings, and detection rules. * Separate environment-specific settings and secrets from reusable integration components. * Provide installation, configuration, upgrade, validation, troubleshooting, and rollback documentation. * Document supported and tested OEM versions, collection interfaces, and required dependencies. * Demonstrate successful installation and validation of the package in a clean lab configuration. 7. Knowledge Transfer and Handoff * Provide a technical walkthrough of the ACS integration architecture and deployment process. * Deliver all source code, configuration files, documentation, and validation evidence to Guard Hawk. * Ensure Guard Hawk can reproduce and maintain the integration without dependence on the original contractor. Acceptance Criteria The project will be considered complete when: 1. One approved ACS product is operational in the Guard Hawk lab. 2. Genuine OEM-generated telemetry is successfully collected and normalized. 3. Three agreed detection scenarios are demonstrated end-to-end, or any infeasible scenario is formally reviewed and replaced with an approved alternative. 4. Applicable MITRE ATT&CK mappings are documented and technically justified. 5. A reusable integration package is delivered and successfully redeployed in a clean lab configuration. 6. Technical documentation, validation results, and knowledge transfer are completed. Project Boundaries * Work will be performed in the isolated Guard Hawk lab environment. * No production deployment is authorized under this engagement. * Additional OEM integrations are outside the initial scope. * OEM software, licensing, and hardware expenses require separate approval. * Production deployment at a customer site will require additional compatibility, security, and acceptance testing. The contractor should demonstrate experience with enterprise ACS integrations, telemetry collection, security event normalization, SIEM/detection engineering, and repeatable deployment practices.