DETECTION AND AUTOMATION ENGINEER
About The Position
The Detection and Automation Engineer develops, tests, tunes, maintains, and documents the analytics, detections, dashboards, scripts, interfaces, and automation used for security monitoring and response. The role combines hands-on engineering with validation, documentation, troubleshooting, and collaboration across analysts, threat hunters, intelligence personnel, platform engineers, and operational stakeholders. The engineer translates threat intelligence, hunt findings, incident lessons, and operational observations into improved detection content and response logic; supports security-tool deployment and integration; and develops automation and response playbooks. The position also validates custom capabilities before operational use and maintains technical content, test cases, operating notes, and training materials. This role is in a hybrid federal customer environment. Onsite work may be required for integration, testing, deployment, or customer-directed activities. The position operates during core business hours and may include assigned after-hours support for automation, detection, and workflow failures. An active Secret clearance and ability to pass a minimum background investigation are required.
Requirements
- Three or more years of cybersecurity engineering, detection engineering, security analytics, or SOC automation experience.
- Experience developing or tuning security analytics in an enterprise SIEM or comparable monitoring platform.
- Experience scripting or integrating systems using Python, PowerShell, APIs, JSON, or comparable technologies.
- Experience testing security capabilities, documenting engineering work, and troubleshooting production issues.
- Ability to collaborate with analysts and stakeholders to translate operational needs into technical solutions.
- Bachelor's degree in cybersecurity, computer science, software engineering, information systems, or a related field; additional relevant experience may be considered in lieu of a degree.
- Active Secret clearance required.
- Ability to pass a minimum background investigation.
Nice To Haves
- Experience with Splunk SPL, Microsoft Sentinel KQL, Sigma, YARA, or comparable detection technologies.
- Experience developing playbooks in a SOAR or workflow-automation platform.
- Working knowledge of MITRE ATT&CK and practical detection-testing methods.
- Experience with cloud telemetry such as AWS CloudTrail, Azure Monitor, or Microsoft 365 audit logs.
- GCIA, GCDA, GCED, Splunk, Microsoft, CySA+, Security+, or comparable role-aligned certifications.
- Experience supporting a 24x7 SOC where detection or automation failures have operational consequences.
Responsibilities
- Develop, test, maintain, and document custom analytics, detections, dashboards, scripts, interfaces, and automation playbooks.
- Tune sensors, rules, alerts, and analytics to improve fidelity, reduce false positives, and support efficient analyst workflows.
- Translate threat intelligence, hunt findings, incident lessons, and operational observations into improved detection content and response logic.
- Prototype and integrate approved technologies or custom capabilities to address monitoring, detection, response, or reporting gaps.
- Validate custom capabilities before operational use and document results, dependencies, limitations, configuration requirements, and maintenance considerations.
- Develop and maintain automation, orchestration, and response playbooks using approved tools and platforms.
- Diagnose and correct failed automation and workflows; safely restore or roll back affected functions and document corrective actions.
- Recommend targeted improvements to SOC tools, workflows, detections, dashboards, scripts, interfaces, and content.
- Support deployment, configuration, integration, and troubleshooting of security tools and sensors.
- Maintain version-controlled technical content, test cases, operating notes, and training materials for detections and automation.
- Participate in assigned after-hours support for automation, detection, and workflow failures.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
