Detection Engineer – SIEM/SOAR

This is a fully remote position, open to applicants in District of Columbia, +1 more state.

📋 Description

• Develop automation, AI-driven (“Super Intelligence”/SI) solutions, and integration workflows that enhance detection and response capabilities.

• Integrate and optimize SIEM, EDR, SOAR, and threat intelligence technologies into a unified detection framework.

• Analyze requirements and convert operational security needs into technical specifications and actionable solutions.

• Test, evaluate, and validate detection systems and automation workflows.

• Foster continuous improvement based on testing outcomes and operational insights.

• Examine security telemetry to detect anomalies, trends, and gaps in detection.

• Propose and implement enhancements for detection mechanisms.

• Create and maintain technical documentation, standard operating procedures (SOPs), and runbooks.

• Collaborate with SOC, threat intelligence, and incident response teams.

• Investigate and evaluate emerging security and AI/ML technologies.

• Design, implement, and sustain automated and AI-driven security detection and integration functionalities across enterprise security monitoring systems.

⛳️ Requirements

• Over 8 years of pertinent cybersecurity experience in detection engineering, security operations, or a closely related area.

• 3-8+ years of relevant experience in detection engineering, SOC operations, or security automation (inferred; see Recruiter Notes).

• Bachelor’s degree in a relevant discipline, or four additional years of applicable experience in lieu of a degree.

• U.S. Citizenship or Permanent Residency is required.

• All work must be performed within the continental U.S.

• CompTIA Security+ (or an equivalent foundational certification) is required.

• One of the following certifications: GCIA, GCIH, or CompTIA CySA+.

• Certification in programming/scripting or a proven proficiency in Python, PowerShell, or similar languages.

• Hands-on experience with SIEM and SOAR platforms, including Splunk Enterprise Security, Splunk SOAR, SentinelOne, and SentinelOne Hyperautomation.

• Familiarity with detection engineering methodologies, SOC operations, and incident response processes.

• Knowledge of NIST SP 800-53, CIS Controls, and the MITRE ATT&CK framework is essential.

• Experience in developing and maintaining technical documentation, SOPs, and runbooks.

• Skills in security platforms including SIEM, EDR, SOAR, API integration, and cloud environments.

• Understanding of Windows, Linux, and Unix operating systems.

• Preferred qualifications include: CISSP or GSEC; CompTIA SecAI+; GMON or similar certifications; prior federal contracting experience; familiarity with NICE Framework, ISO 27001/27002, FISMA, FedRAMP, OMB circulars, federal cybersecurity directives, and Privacy Act; experience in malware analysis, digital forensics, risk assessment, and machine learning/AI security detection.

🏝️ Benefits

• Medical — Multiple POS health plan options, including an HSA-compatible plan.

• Dental — PPO coverage for preventive, basic, and major services.

• Vision — Annual exam, frames, lenses, and contact lens allowance provided.

• 401(k) — Employer match up to 5% of eligible compensation.

• Long-Term Disability — 100% employer-paid coverage at 50% of pre-disability earnings.

• Life Insurance & AD&D — 100% employer-paid coverage valued at $10,000 each.

• PTO — 15–25 days annually based on tenure.

• Paid Federal Holidays — All 11 federal holidays are observed.