Cyber Detection Engineer Subject Matter Expert

Argo Cyber Systems • Arlington, VA

7d • Onsite

About The Position

Argo Cyber Systems, LLC is seeking a senior Cyber Detection Engineer Subject Matter Expert to support a mission-critical U.S. Government cybersecurity program defending federal civilian agencies and critical infrastructure. The role leads the development, validation, deployment, and optimization of detection capabilities for proactive threat hunting, incident response, and enterprise security operations. The engineer translates threat intelligence, investigative findings, incident response lessons, and exercise results into scalable behavioral analytics, detection logic, and automated defensive capabilities across endpoint, network, identity, cloud, and application environments.

The position also provides senior technical advice and leadership, improves telemetry and monitoring capabilities, evaluates security technologies and analytical methods, and communicates detection coverage, operational risks, and security gaps to technical leadership and government stakeholders. The role is based in Arlington, Virginia, and requires an active TS/SCI clearance, U.S. citizenship, and the ability to obtain DHS Suitability.

Requirements

• At least 10 years of directly relevant professional experience.
• Senior-level experience in threat hunting, detection engineering, incident response, or closely related defensive cybersecurity operations.
• Active Top Secret / Sensitive Compartmented Information (TS/SCI) security clearance.
• U.S. citizenship and ability to obtain DHS Suitability.
• Bachelor's degree in Engineering, Computer Science, Cybersecurity, Information Systems, or a related technical field.
• Experience independently developing, deploying, and maintaining production detection content.
• Ability to translate operational threat intelligence and investigative findings into effective security detection capabilities.
• Experience coordinating security engineering improvements across multidisciplinary technical teams.
• Advanced knowledge of hypothesis-driven threat hunting, adversary behavior analysis, and evidence-based cybersecurity investigations.
• Ability to design, test, deploy, optimize, and maintain production detection rules and behavioral analytics.
• Advanced proficiency in at least one security query language, such as Splunk SPL, Kusto Query Language (KQL), Elasticsearch EQL, Elasticsearch ES|QL, or vendor-specific EDR query languages.
• Strong understanding of Windows and Linux internals, enterprise networking, identity management, and cloud security telemetry.
• Experience analyzing process execution, command-line activity, process ancestry, authentication events, persistence mechanisms, and network connections.
• Practical experience applying MITRE ATT&CK to detection engineering, adversary behavior analysis, and security coverage assessments.
• Ability to assess detection fidelity, false positives, false negatives, exclusions, and suppression risks.
• Proficiency with Python, PowerShell, or comparable scripting languages for security analytics, automation, testing, and enrichment.
• Experience identifying telemetry gaps and translating operational needs into technical requirements and acceptance criteria.
• Strong technical writing skills, including documenting detection logic, validation procedures, investigative guidance, and tuning decisions.

Nice To Haves

• Master's degree in a relevant technical discipline.
• Experience with CrowdStrike Falcon, Microsoft Defender, Palo Alto Cortex XDR, SentinelOne, Splunk, Elastic Security, or comparable enterprise SIEM and EDR platforms.
• Experience developing portable detection content using Sigma.
• Familiarity with detection-as-code methodologies, version-controlled detection repositories, and automated validation.
• Experience with SIEM data onboarding, security telemetry normalization, and pipeline optimization.
• Experience designing and executing adversary emulation, purple team exercises, and cyber defense validation scenarios.
• Knowledge of advanced behavioral analytics and automated detection workflows.
• Experience supporting federal civilian cybersecurity programs or critical infrastructure environments.
• Familiarity with government incident response, threat hunting, and enterprise defensive cyber operations.
• Experience developing detection engineering training programs, JQRs, practical assessments, and technical competency standards.
• Demonstrated ability to work with government stakeholders and multidisciplinary cybersecurity teams.
• One or more preferred certifications: GIAC Certified Detection Analyst (GCDA), GIAC Certified Forensic Analyst (GCFA), GIAC Defending Advanced Threats (GDAT), GIAC Certified Intrusion Analyst (GCIA), GIAC Certified Incident Handler (GCIH), GIAC Cyber Threat Intelligence (GCTI), Microsoft Certified: Security Operations Analyst Associate (SC-200), or CISSP.

Responsibilities

• Develop and execute hypothesis-driven threat hunts for advanced adversary activity, including persistence, privilege escalation, credential access, lateral movement, command and control, and defense evasion.
• Design, develop, test, deploy, and maintain behavioral analytics, correlation rules, detection signatures, and investigative queries using endpoint, network, identity, cloud, and application telemetry.
• Focus detection strategies on adversary tactics, techniques, and procedures (TTPs), correlate evidence across security data sources, and document investigative conclusions.
• Translate threat intelligence, hunt findings, incident response lessons, and cyber exercise results into reusable detection capabilities; map detection content to MITRE ATT&CK and document coverage evidence.
• Validate detection logic against malicious and benign activity using historical telemetry, simulations, and purple team exercises.
• Analyze false positives and negatives, alert volume, thresholds, and environmental baselines; optimize detection fidelity while limiting unnecessary analyst workload and assessing evasion and tuning risks.
• Maintain detection documentation covering analytical intent, data sources, investigation procedures, assumptions, validation results, and limitations.
• Establish and maintain peer review, version control, deployment standards, release approvals, rollback processes, and revalidation following platform, schema, environmental, or adversary changes.
• Assess security telemetry availability, reliability, and quality; identify gaps in sensor coverage, log collection, parsing, normalization, retention, and accessibility.
• Coordinate with infrastructure engineers, platform administrators, and technical delivery teams to resolve visibility and collection deficiencies.
• Translate operational detection gaps into engineering requirements and acceptance criteria, validate improvements, and evaluate technologies and data sources against mission needs.
• Develop and maintain automation for detection, data enrichment, query execution, investigation workflows, and validation; build or enhance SOAR playbooks where applicable.
• Optimize analytical queries and security data pipelines, and implement appropriate review mechanisms, error handling, and recovery procedures in automated workflows.
• Collaborate with analytics developers and data scientists to assess advanced analytical methods, including machine learning, before recommending production use.
• Serve as a senior technical advisor for threat hunting, detection engineering, vulnerability management, and defensive cyber operations.
• Collaborate with threat hunters, incident responders, cyber threat intelligence analysts, and platform engineering teams.
• Develop cyber exercise scenarios and expected detection outcomes; assess sensing failures, identify operational risks, and coordinate corrective actions.
• Review analytical work products, mentor cybersecurity analysts and engineers, and establish standards for detection development, documentation, testing, deployment, and optimization.
• Support detection engineering competencies, Job Qualification Requirements (JQRs), training scenarios, and practical assessments.
• Communicate detection effectiveness, validated coverage, operational risks, and remaining security gaps to technical leadership and government stakeholders.

Benefits

• Opportunity to support national cybersecurity missions defending federal civilian agencies and critical infrastructure.
• Opportunity to engineer advanced detection capabilities and improve operational response.
• Opportunity to work with modern SIEM, EDR, automation, threat hunting, and security analytics technologies.
• Collaboration with experienced threat hunters, incident responders, intelligence analysts, and security engineers.
• Opportunity to drive technical innovation and improve detection coverage and security posture in mission-critical government environments.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior