Cyber Threat Detection Engineer (SIEM / Signatures)

RISA•St. Louis, MO

1d•Onsite

About The Position

RISA is hiring an advanced cybersecurity analytics specialist to develop and maintain the defensive countermeasures protecting an Intelligence Community customer's enterprise. You will work in a Fusion model alongside Focused Operations under Defensive Cyber Operations. This is hunt and detection engineering, not queue-clearing: you write and tune the logic that prevents a compromise and evicts adversaries who are already persistent. You will talk to the owner here, not a recruiting queue.

Requirements

U.S. citizenship and an active TS/SCI.
Ability to successfully obtain and maintain a Government polygraph after hire.
Bachelor's degree in a field applicable to the position plus 6 years of relevant experience. Equivalents accepted - Master's plus 4, Associate's plus 8, or High School diploma/GED plus 10.
8+ years of related advanced cyber security analytics experience.
A certification compliant with DoD 8140.01 and 8570.01-M IAT Level III and CSSP Analyst.
Data mining or query building in a SIEM.
Strong signature development and tuning, and strong network protocol analysis with protocol analyzers.
Static file signatures (magic numbers) and good working knowledge of regular expressions.

Nice To Haves

Hex editor comfort; Python, Bash, or PowerShell scripting.
Purple Team tactics; cloud security - visibility gaps, data lakes, and data mining.

Responsibilities

Analyze trends and patterns to identify and predict previously undiscovered events, then develop or tune the rules, signatures, and scripts that catch them.
Turn intelligence and incident reporting into deployed detection logic.
Run regular Purple Team exercises and continuously validate countermeasures already deployed.
Work with the Cyber Data Analytics team on SIEM alert efficiency, evaluating valid alerts against false positives.
Support the Cyber Incident Response Team during live activity, predicting adversary response and locations of compromise to assist triage.
Document work in the authorized ticketing system so any stakeholder can reconstruct the analysis.