Job OverviewWe are seeking a
Threat Detection Engineer to join our team. You will engineer advanced threat detection use cases and develop custom SIEM scripts to proactively defend critical enterprise systems against emerging cyber threats. Additionally, you will collaborate closely with cross-functional stakeholders to optimize data telemetry, identify security capability gaps, and prioritize high-fidelity alerting tailored to specific applications. You will be located in Richmond, VA. A hybrid schedule may be possible after a preliminary period.
Responsibilities include, but are not limited to:Threat Detection Engineering & Use Case Development- Continuously researching emerging threats and integrating threat intelligence to design, develop, and refine new threat detection use cases and custom signatures tailored to individual programs and critical applications.
SIEM Optimization & Automation- Enhancing Security Information and Event Management (SIEM) platforms by developing custom scripts, driving automation, and expanding overall security analytics capabilities.
Telemetry Optimization & Data Quality Assurance- Conducting rigorous reviews of incoming data feeds and telemetry to recommend and implement technical improvements, ensuring high-fidelity data ingestion for accurate alerting.
Security Gap Analysis & Cross-Functional Collaboration- Partnering seamlessly with cybersecurity Subject Matter Experts (SMEs), system owners, and Threat Detection Analysts to identify vulnerabilities, define alerting priorities, and establish comprehensive protection strategies for critical systems.
Required Qualifications:- Must possess at least one of the following certifications: CompTIA Cybersecurity Analyst Plus (CySA+), GIAC Certified Forensic Analyst (GCFA), GIAC Certified Intrusion Analyst (GCIA), Global Industrial Cyber Security Professional (GICSP).
- A minimum of five (5) years of relevant IT experience.
- A minimum of three (3) years working with a SIEM in a content development or Incident Response role.
- A minimum of three (3) years of System and/or Network Administration experience.
- Understanding of various log formats.
- Understanding of the MITRE ATT&CK framework.
- Strong understanding of network architecture.
- Experience developing and maintaining scripts (preferably using PowerShell, Python or SPL).
- Understanding of Defense-in-Depth.
Preferred Qualifications:- A bachelor's degree in a relevant field of study.
Clearance Requirements:- Must be a U.S. citizen.
- Must possess a DoD current Top-Secret clearance.
