Detection Engineer Analyst

Resource Management Concepts, Inc.•Quantico, VA

6d•$120,000 - $140,000•Onsite

About The Position

Resource Management Concepts, Inc. (RMC) is hiring a Detection Engineer Analyst to support an active government contract in Quantico, Virginia. The role provides defensive cyberspace operations and Cyber Security Service Provider (CSSP) functions in support of the government’s mission to deny, disrupt, and degrade adversaries’ attempts to disrupt, exploit, and attack IT services provided to network users. The analyst develops and maintains detection capabilities based on current threats, the MITRE ATT&CK framework, and government direction. The role reviews incident reporting and SIEM/SOAR queues, identifies logging and detection gaps, assists with new log ingestion, and creates high-fidelity detection rules and automations while maintaining a low false-positive rate. This is a full-time, Monday-to-Friday day-shift position, normally not exceeding 40 hours per week. Occasional extended or non-standard hours may be required for major cyber incidents. The position is considered essential and may require reporting during hazardous weather, power outages, fuel shortages, pandemics, and other emergencies. The salary range is $120,000 to $140,000 annually. RMC highlights career development and offers tuition assistance, certifications, and paid relocation assistance.

Requirements

Active TS/SCI eligibility is required; a selected applicant may begin work with an active DoD SECRET clearance and must maintain eligibility for access to classified information.
Either a college degree in a technical or managerial-related discipline and five years of practical experience in cybersecurity, engineering, information technology, and/or defensive cyberspace operations, or a high school diploma or equivalency certificate and seven years of practical experience in those areas.
DoD 8570 IAT Level III certification.
DoD 8570 CSSP Analyst certification.
Experience writing signatures, such as KQL, Snort, ePO, or Yara, for network and host IDS/IPS.

Nice To Haves

Microsoft Cloud Security training is highly recommended.
Experience or training with Microsoft Azure and Microsoft Defender XDR.
Microsoft Sentinel Ninja Training.
Microsoft Defender for Endpoint Ninja Training.
Microsoft Defender for Identity Ninja Training.
Microsoft SC-XXX training or certifications.

Responsibilities

Develop detection use cases based on current threats, the MITRE ATT&CK framework, and government direction.
Review incident reporting and tune related detection use cases as necessary.
Review the SIEM/SOAR incident queue for unnecessary events and alerts and implement corrective actions.
Identify gaps in logging and detection capabilities across the attack surface.
Assist in implementing new log ingestion and verify proper parsing and normalization of data in SIEM/SOAR.
Create and maintain high-fidelity correlation rules, signatures, filters, and automations while keeping false positives low.