Cyber Detection Engineer Subject Matter Expert

Cyber Detection Engineer Subject Matter Expert (SME)

Argo Cyber Systems, LLC | Federal Cybersecurity Operations

Security Clearance: Active Top Secret / SCI (TS/SCI) Required
Citizenship: U.S. Citizenship Required
Suitability: Must be able to obtain DHS Suitability
Experience Level: Senior / Subject Matter Expert
Work Location: Arlingotn VA
Position Overview

In this role, you will lead the development, validation, deployment, and optimization of advanced cybersecurity detection capabilities supporting proactive threat hunting, incident response, and enterprise security operations.

The ideal candidate combines extensive threat hunting experience, sophisticated adversary behavior analysis, and hands-on detection engineering expertise. You will transform threat intelligence, investigative findings, and incident response lessons into scalable behavioral analytics, reliable detection logic, and automated defensive capabilities.

Working across endpoint, network, identity, cloud, and application environments, you will help identify sophisticated threats, eliminate security visibility gaps, and continuously improve detection effectiveness.

This position offers an opportunity to directly strengthen the nation's cyber defenses by engineering advanced detection capabilities that identify malicious activity before it can significantly impact federal systems and critical infrastructure.
Key Responsibilities
Advanced Threat Hunting and Detection Engineering

• Develop and execute hypothesis-driven threat hunting methodologies to identify advanced adversary activity, including persistence, privilege escalation, credential access, lateral movement, command and control, and defense evasion.
• Design, develop, test, and deploy advanced behavioral analytics, correlation rules, detection signatures, and investigative queries.
• Develop detection logic using endpoint, network, identity, cloud, and application telemetry.
• Focus detection strategies on adversary tactics, techniques, and procedures (TTPs) rather than relying exclusively on indicators of compromise.
• Correlate evidence across multiple security data sources to identify suspicious activity and produce defensible investigative conclusions.
• Translate threat intelligence, hunt findings, incident response lessons, and cyber exercise results into reusable detection capabilities.
• Map detection content to MITRE ATT&CK techniques and document the evidence supporting detection coverage.

Detection Validation, Optimization, and Quality Assurance

• Validate detection logic against representative malicious and benign activity using historical telemetry, controlled simulations, and purple team exercises.
• Analyze false positives, false negatives, alert volume, detection thresholds, and environmental baselines.
• Optimize detection fidelity while minimizing unnecessary analyst workload and preserving visibility into legitimate threats.
• Evaluate detection evasion opportunities and assess the operational impact of exclusions, suppression rules, and tuning decisions.
• Develop and maintain detection documentation, including analytical intent, required data sources, investigation procedures, assumptions, validation results, and known limitations.
• Establish and maintain peer-review procedures, version control, deployment standards, release approvals, and rollback processes.
• Revalidate detection content following platform updates, schema changes, environmental modifications, and evolving adversary techniques.

Security Telemetry and Engineering Integration

• Assess the availability, reliability, and quality of enterprise security telemetry and monitoring capabilities.
• Identify gaps in sensor coverage, log collection, parsing, normalization, retention, and data accessibility.
• Coordinate with infrastructure engineers, platform administrators, and technical delivery teams to resolve visibility and collection deficiencies.
• Translate operational threat hunting and detection gaps into actionable engineering requirements and measurable acceptance criteria.
• Validate implemented improvements to ensure security capabilities meet operational requirements.
• Evaluate emerging security technologies, data sources, and analytical techniques against identified mission needs.

Security Automation and Advanced Analytics

• Develop and maintain automation supporting threat detection, data enrichment, query execution, investigation workflows, and detection validation.
• Build or enhance Security Orchestration, Automation, and Response (SOAR) playbooks where applicable.
• Optimize analytical queries and security data pipelines to improve performance, scalability, and responsiveness.
• Implement appropriate review mechanisms, error handling, and recovery procedures within automated workflows.
• Collaborate with analytics developers and data scientists to evaluate advanced analytical methods, including machine learning where operationally appropriate.
• Assess analytical effectiveness, false-positive rates, data dependencies, and technical limitations before recommending production adoption.

Technical Leadership and Mission Support

• Serve as a senior technical advisor supporting threat hunting, detection engineering, vulnerability management, and defensive cyber operations.
• Collaborate with threat hunters, incident responders, cyber threat intelligence analysts, and platform engineering teams.
• Develop cyber exercise scenarios and define expected detection outcomes to evaluate defensive capabilities.
• Assess sensing failures, identify operational risks, and coordinate corrective actions.
• Review analytical work products and mentor cybersecurity analysts and engineers.
• Establish technical standards for detection development, documentation, testing, deployment, and optimization.
• Support development of detection engineering competencies, Job Qualification Requirements (JQRs), training scenarios, and practical assessments.
• Communicate detection effectiveness, validated coverage, operational risks, and remaining security gaps to technical leadership and government stakeholders.

Required Qualifications
Security and Eligibility

• U.S. Citizenship is required.
• Active Top Secret / Sensitive Compartmented Information (TS/SCI) security clearance is required.
• Must be able to obtain DHS Suitability.

Professional Experience

• Minimum 10 years of directly relevant professional experience.
• Demonstrated senior-level experience in threat hunting, detection engineering, incident response, or closely related defensive cybersecurity operations.
• Proven experience independently developing, deploying, and maintaining production detection content.
• Demonstrated ability to translate operational threat intelligence and investigative findings into effective security detection capabilities.
• Experience coordinating security engineering improvements across multidisciplinary technical teams.

Technical Expertise

• Advanced knowledge of hypothesis-driven threat hunting, adversary behavior analysis, and evidence-based cybersecurity investigations.
• Proven ability to design, test, deploy, optimize, and maintain production detection rules and behavioral analytics.
• Advanced proficiency in one or more security query languages, including:
  
  • Splunk Search Processing Language (SPL)
  • Kusto Query Language (KQL)
  • Elasticsearch Query Language (EQL)
  • Elasticsearch ES|QL
  • Vendor-specific endpoint detection and response query languages
• Strong understanding of Windows and Linux operating system internals, enterprise networking, identity management, and cloud security telemetry.
• Experience analyzing process execution, command-line activity, process ancestry, authentication events, persistence mechanisms, and network connections.
• Practical experience applying MITRE ATT&CK to detection engineering, adversary behavior analysis, and security coverage assessments.
• Ability to evaluate detection fidelity, false positives, false negatives, exclusions, and suppression risks.
• Proficiency with Python, PowerShell, or comparable scripting languages for security analytics, automation, testing, and enrichment.
• Experience identifying telemetry gaps and translating operational needs into technical requirements and acceptance criteria.
• Strong technical writing skills, including documenting detection logic, validation procedures, investigative guidance, and tuning decisions.

Preferred Qualifications

Candidates with experience in the following technologies and operational environments are especially encouraged to apply:

Security Platforms and Technologies

• CrowdStrike Falcon
• Microsoft Defender
• Palo Alto Cortex XDR
• SentinelOne
• Splunk
• Elastic Security
• Comparable enterprise SIEM and EDR platforms

Advanced Detection Engineering

• Experience developing portable detection content using Sigma.
• Familiarity with detection-as-code methodologies, version-controlled detection repositories, and automated validation.
• Experience with SIEM data onboarding, security telemetry normalization, and pipeline optimization.
• Experience designing and executing adversary emulation, purple team exercises, and cyber defense validation scenarios.
• Knowledge of advanced behavioral analytics and automated detection workflows.

Federal Cybersecurity Operations

• Experience supporting federal civilian cybersecurity programs or critical infrastructure environments.
• Familiarity with government incident response, threat hunting, and enterprise defensive cyber operations.
• Experience developing detection engineering training programs, JQRs, practical assessments, and technical competency standards.
• Demonstrated ability to work with government stakeholders and multidisciplinary cybersecurity teams.

Education Requirements

Required: Bachelor's degree in Engineering, Computer Science, Cybersecurity, Information Systems, or a related technical field.

Preferred: Master's degree in a relevant technical discipline.
Desired Professional Certifications

One or more of the following certifications is preferred:

• GIAC Certified Detection Analyst (GCDA)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Defending Advanced Threats (GDAT)
• GIAC Certified Intrusion Analyst (GCIA)
• GIAC Certified Incident Handler (GCIH)
• GIAC Cyber Threat Intelligence (GCTI)
• Microsoft Certified: Security Operations Analyst Associate (SC-200)
• Certified Information Systems Security Professional (CISSP)

Apply Today

If you are an experienced cybersecurity professional with deep expertise in threat hunting, advanced detection engineering, and adversary behavior analysis, we encourage you to explore this opportunity with Argo Cyber Systems.

Join a mission-focused team working to develop the next generation of cybersecurity detection capabilities supporting the U.S. Government.

Position: Cyber Detection Engineer Subject Matter Expert (SME)
Company: Argo Cyber Systems, LLC
Security Clearance: Active TS/SCI Required
Citizenship: U.S. Citizenship Required
Suitability: Must be able to obtain DHS Suitability