3+ years in cybersecurity engineering, detection engineering, or SOC automation.
Experience with enterprise SIEM or similar monitoring platforms.
Proficient in scripting with Python, PowerShell, or APIs.
Skilled in testing security capabilities and troubleshooting production issues.
Strong collaboration skills to translate operational needs into technical solutions.
Responsibilities
Develop and document custom analytics, detections, and automation playbooks.
Tune sensors and alerts to enhance detection fidelity and reduce false positives.
Translate threat intelligence and operational observations into detection improvements.
Prototype and integrate technologies to fill monitoring and detection gaps.
Validate and document custom capabilities before operational use.
Develop automation and orchestration playbooks using approved tools.
Diagnose and correct automation failures, documenting corrective actions.
Benefits
Hybrid work environment with onsite requirements for specific tasks.
Participation in after-hours support for critical failures.
Opportunities for professional development and training.
Full Job Description
Detection and Automation Engineer
Position Overview
The Detection and Automation Engineer develops, tests, tunes, maintains, and documents the analytics, detections, dashboards, scripts, interfaces, and automation that support security monitoring and response. The role combines hands-on engineering with disciplined validation, documentation, troubleshooting, and collaboration across analysts, threat hunters, intelligence personnel, platform engineers, and operational stakeholders.
Duties & Responsibilities
Develop, test, maintain, and document custom analytics, detections, dashboards, scripts, interfaces, and automation playbooks.
Tune sensors, rules, alerts, and analytics to improve fidelity, reduce false positives, and support efficient analyst workflows.
Translate threat intelligence, hunt findings, incident lessons, and operational observations into improved detection content and response logic.
Prototype and integrate approved technologies or custom capabilities needed to address monitoring, detection, response, or reporting gaps.
Validate custom capabilities before operational use and document results, dependencies, limitations, configuration requirements, and maintenance considerations.
Develop and maintain automation, orchestration, and response playbooks using approved tools and platforms.
Diagnose and correct failed automation and workflows; safely restore or roll back affected functions and document corrective actions.
Recommend targeted improvements to SOC tools, workflows, detections, dashboards, scripts, interfaces, and content.
Support deployment, configuration, integration, and troubleshooting of security tools and sensors.
Maintain version-controlled technical content, test cases, operating notes, and training materials for detections and automation.
Qualifications
Minimum Requirements:
Three or more years of cybersecurity engineering, detection engineering, security analytics, or SOC automation experience.
Experience developing or tuning security analytics in an enterprise SIEM or comparable monitoring platform.
Experience scripting or integrating systems using Python, PowerShell, APIs, JSON, or comparable technologies.
Experience testing security capabilities, documenting engineering work, and troubleshooting production issues.
Ability to collaborate with analysts and stakeholders to translate operational needs into technical solutions.
Preferred Qualifications:
Experience with Splunk SPL, Microsoft Sentinel KQL, Sigma, YARA, or comparable detection technologies.
Experience developing playbooks in a SOAR or workflow-automation platform.
Working knowledge of MITRE ATT&CK and practical detection-testing methods.
Experience with cloud telemetry such as AWS CloudTrail, Azure Monitor, or Microsoft 365 audit logs.
Experience supporting a 24x7 SOC where detection or automation failures have operational consequences.
What Success Looks Like
Detection content is accurate, maintainable, testable, and tied to operational needs and observable data.
Automation reduces manual effort without obscuring failure, creating unmanaged risk, or weakening analyst control.
False positives, duplicate coverage, stale content, and broken workflows are identified and corrected promptly.
Technical content and test evidence are sufficient for repeatable deployment, maintenance, and operational handoff.
Education and Certifications:
Minimum: Bachelor's degree in cybersecurity, computer science, software engineering, information systems, or a related field; additional relevant experience may be considered in lieu of a degree
Clearance Level:
Active Secret clearance required.
Work Location
Hybrid federal customer environment. Onsite work may be required for integration, testing, deployment, or customer-directed activities.
Hours of Operation
Core business hours with participation in after-hours support for automation, detection, and workflow failures as assigned.
Ability to pass a minimum background investigation.
