Cyber Detection Engineer Subject Matter Expert

Argo Cyber Systems•Arlington, VA

10d•$140,000 - $160,000•Onsite

About The Position

Argo Cyber Systems is seeking a senior Cyber Detection Engineer Subject Matter Expert to support a mission-critical U.S. Government cybersecurity program defending federal civilian agencies and critical infrastructure against advanced cyber threats. The role leads the development, validation, deployment, and optimization of detection capabilities for proactive threat hunting, incident response, and enterprise security operations. It translates threat intelligence, investigative findings, and incident-response lessons into scalable behavioral analytics, reliable detection logic, and automated defensive capabilities across endpoint, network, identity, cloud, and application environments. The SME serves as a senior technical advisor, helping identify sophisticated threats, close security visibility gaps, and improve detection effectiveness. The position also establishes technical standards and quality practices, supports team development and training, and communicates validated coverage, operational risks, and remaining security gaps to technical leadership and government stakeholders. The role is based in Arlington, Virginia, and requires U.S. citizenship, an active TS/SCI clearance, and the ability to obtain DHS Suitability.

Requirements

Minimum 10 years of directly relevant professional experience.
Senior-level experience in threat hunting, detection engineering, incident response, or closely related defensive cybersecurity operations.
Proven experience independently developing, deploying, and maintaining production detection content.
Demonstrated ability to translate operational threat intelligence and investigative findings into effective security detection capabilities.
Experience coordinating security engineering improvements across multidisciplinary technical teams.
Advanced knowledge of hypothesis-driven threat hunting, adversary behavior analysis, and evidence-based cybersecurity investigations.
Ability to design, test, deploy, optimize, and maintain production detection rules and behavioral analytics.
Advanced proficiency in one or more security query languages, such as Splunk Search Processing Language (SPL), Kusto Query Language (KQL), Elasticsearch Query Language (EQL), Elasticsearch ES|QL, or vendor-specific EDR query languages.
Strong understanding of Windows and Linux internals, enterprise networking, identity management, and cloud security telemetry.
Experience analyzing process execution, command-line activity, process ancestry, authentication events, persistence mechanisms, and network connections.
Practical experience applying MITRE ATT&CK to detection engineering, adversary behavior analysis, and security coverage assessments.
Ability to evaluate detection fidelity, false positives, false negatives, exclusions, and suppression risks.
Proficiency with Python, PowerShell, or comparable scripting languages for security analytics, automation, testing, and enrichment.
Experience identifying telemetry gaps and translating operational needs into technical requirements and acceptance criteria.
Strong technical writing skills, including documenting detection logic, validation procedures, investigative guidance, and tuning decisions.
U.S. citizenship is required.
Active Top Secret / Sensitive Compartmented Information (TS/SCI) security clearance is required.
Must be able to obtain DHS Suitability.
Bachelor's degree in Engineering, Computer Science, Cybersecurity, Information Systems, or a related technical field.

Nice To Haves

Master's degree in a relevant technical discipline.
Experience with CrowdStrike Falcon, Microsoft Defender, Palo Alto Cortex XDR, SentinelOne, Splunk, Elastic Security, or comparable enterprise SIEM and EDR platforms.
Experience developing portable detection content using Sigma.
Familiarity with detection-as-code methodologies, version-controlled detection repositories, and automated validation.
Experience with SIEM data onboarding, security telemetry normalization, and pipeline optimization.
Experience designing and executing adversary emulation, purple-team exercises, and cyber-defense validation scenarios.
Knowledge of advanced behavioral analytics and automated detection workflows.
Experience supporting federal civilian cybersecurity programs or critical infrastructure environments.
Familiarity with government incident response, threat hunting, and enterprise defensive cyber operations.
Experience developing detection engineering training programs, JQRs, practical assessments, and technical competency standards.
Demonstrated ability to work with government stakeholders and multidisciplinary cybersecurity teams.
One or more preferred certifications: GIAC Certified Detection Analyst (GCDA), GIAC Certified Forensic Analyst (GCFA), GIAC Defending Advanced Threats (GDAT), GIAC Certified Intrusion Analyst (GCIA), GIAC Certified Incident Handler (GCIH), GIAC Cyber Threat Intelligence (GCTI), Microsoft Certified: Security Operations Analyst Associate (SC-200), or Certified Information Systems Security Professional (CISSP).

Responsibilities

Develop and execute hypothesis-driven threat hunts for advanced adversary activity, including persistence, privilege escalation, credential access, lateral movement, command and control, and defense evasion.
Design, develop, test, and deploy behavioral analytics, correlation rules, detection signatures, and investigative queries using endpoint, network, identity, cloud, and application telemetry.
Focus detection strategies on adversary tactics, techniques, and procedures (TTPs), correlate evidence across security data sources, and document investigative conclusions.
Translate threat intelligence, hunt findings, incident-response lessons, and cyber-exercise results into reusable detection capabilities; map detection content to MITRE ATT&CK and document supporting evidence.
Validate detection logic against representative malicious and benign activity using historical telemetry, controlled simulations, and purple-team exercises.
Analyze false positives, false negatives, alert volumes, detection thresholds, and environmental baselines; optimize detection fidelity while minimizing unnecessary analyst workload.
Evaluate detection evasion opportunities and the operational impact of exclusions, suppression rules, and tuning decisions.
Maintain detection documentation covering analytical intent, required data sources, investigation procedures, assumptions, validation results, and known limitations.
Establish and maintain peer review, version control, deployment standards, release approvals, and rollback processes; revalidate detections after platform, schema, environment, or adversary changes.
Assess enterprise security telemetry and monitoring for availability, reliability, and quality; identify gaps in sensor coverage, collection, parsing, normalization, retention, and accessibility.
Coordinate with infrastructure engineers, platform administrators, and technical delivery teams to resolve visibility and collection deficiencies.
Translate hunting and detection gaps into actionable engineering requirements and measurable acceptance criteria, then validate implemented improvements.
Evaluate emerging security technologies, data sources, and analytical techniques against mission needs.
Develop and maintain automation for threat detection, data enrichment, query execution, investigation workflows, and detection validation; build or enhance SOAR playbooks where applicable.
Optimize analytical queries and security data pipelines, and implement review mechanisms, error handling, and recovery procedures in automated workflows.
Collaborate with analytics developers and data scientists to evaluate advanced analytical methods, including machine learning where operationally appropriate, and assess their effectiveness and limitations before production adoption.
Serve as a senior technical advisor for threat hunting, detection engineering, vulnerability management, and defensive cyber operations.
Collaborate with threat hunters, incident responders, cyber threat intelligence analysts, and platform engineering teams.
Develop cyber-exercise scenarios and expected detection outcomes; assess sensing failures, identify operational risks, and coordinate corrective actions.
Review analytical work products and mentor cybersecurity analysts and engineers.
Establish technical standards for detection development, documentation, testing, deployment, and optimization.
Support development of detection engineering competencies, Job Qualification Requirements (JQRs), training scenarios, and practical assessments.
Communicate detection effectiveness, validated coverage, operational risks, and remaining security gaps to technical leadership and government stakeholders.