Detection And Automation Engineer

Zermount•Arlington, VA

8d•Hybrid

About The Position

The Detection and Automation Engineer develops, tests, tunes, maintains, and documents analytics, detections, dashboards, scripts, interfaces, and automation supporting security monitoring and response. The role combines hands-on engineering with validation, documentation, troubleshooting, and collaboration with analysts, threat hunters, intelligence personnel, platform engineers, and operational stakeholders. The engineer translates threat intelligence, hunt findings, incident lessons, and operational observations into improved detection content and response logic. The role also prototypes and integrates approved technologies or custom capabilities to address monitoring, detection, response, and reporting gaps, and validates those capabilities before operational use. Documentation includes results, dependencies, limitations, configuration requirements, and maintenance considerations. The position supports deployment, configuration, integration, and troubleshooting of security tools and sensors. It maintains version-controlled technical content, test cases, operating notes, and training materials. The role is based in a hybrid federal customer environment, with onsite work potentially required for integration, testing, deployment, or customer-directed activities. Core business hours apply, with assigned after-hours support for automation, detection, and workflow failures. An active Secret clearance and the ability to pass a minimum background investigation are required.

Requirements

Three or more years of cybersecurity engineering, detection engineering, security analytics, or SOC automation experience.
Experience developing or tuning security analytics in an enterprise SIEM or comparable monitoring platform.
Experience scripting or integrating systems using Python, PowerShell, APIs, JSON, or comparable technologies.
Experience testing security capabilities, documenting engineering work, and troubleshooting production issues.
Ability to collaborate with analysts and stakeholders to translate operational needs into technical solutions.
Bachelor's degree in cybersecurity, computer science, software engineering, information systems, or a related field; additional relevant experience may be considered in lieu of a degree.
Active Secret clearance required.
Ability to pass a minimum background investigation.

Nice To Haves

Experience with Splunk SPL, Microsoft Sentinel KQL, Sigma, YARA, or comparable detection technologies.
Experience developing playbooks in a SOAR or workflow-automation platform.
Working knowledge of MITRE ATT&CK and practical detection-testing methods.
Experience with cloud telemetry such as AWS CloudTrail, Azure Monitor, or Microsoft 365 audit logs.
GCIA, GCDA, GCED, Splunk, Microsoft, CySA+, Security+, or comparable role-aligned certifications.
Experience supporting a 24x7 SOC where detection or automation failures have operational consequences.

Responsibilities

Develop, test, maintain, and document custom analytics, detections, dashboards, scripts, interfaces, and automation playbooks.
Tune sensors, rules, alerts, and analytics to improve fidelity, reduce false positives, and support efficient analyst workflows.
Translate threat intelligence, hunt findings, incident lessons, and operational observations into improved detection content and response logic.
Prototype and integrate approved technologies or custom capabilities to address monitoring, detection, response, or reporting gaps.
Validate custom capabilities before operational use and document results, dependencies, limitations, configuration requirements, and maintenance considerations.
Develop and maintain automation, orchestration, and response playbooks using approved tools and platforms.
Diagnose and correct failed automation and workflows; safely restore or roll back affected functions and document corrective actions.
Recommend targeted improvements to SOC tools, workflows, detections, dashboards, scripts, interfaces, and content.
Support deployment, configuration, integration, and troubleshooting of security tools and sensors.
Maintain version-controlled technical content, test cases, operating notes, and training materials for detections and automation.