Detection Engineer

Edgewater Federal Solutions • Bethesda, MD

1d

About The Position

Edgewater is seeking a Detection Engineer. As a Splunk User and Entity Behavior (UBA) Engineer, you’ll join a Cyber Security Ops organization that supports a leading federal healthcare client. This role involves maintaining and operating the Splunk application monitoring tool as part of the client's Cybersecurity network and application audit and monitoring program within the Threat Monitoring and Incident Response (TMIR) team. The position requires applying strategic, operational, and tactical cyber intelligence to improve security operations, leading efforts to prepare for, monitor, detect, analyze, contain, remediate, and recover from security incidents. The role also includes developing and implementing actionable alerts and workflows for Splunk as a CISO Monitoring tool, creating Apps & Knowledge Objects (like Dashboards and Reports), providing analyst training, developing automation, communicating with customer stakeholders, conducting deep analysis and hunting operations, configuring incident response workflows for ES, and performing technical writing for TMIR documentation. Additionally, the role involves building relationships with clients and internal teams, co-leading client calls, and demonstrating the ability to take direction and achieve quality results independently.

Requirements

• U.S. Citizenship is required per contract to obtain and maintain a U.S. security clearance.
• Experience in a rapid paced, time sensitive, high-quality environment.
• At least 5 years of strong problem-solving capabilities and the ability to effectively communicate solutions.
• One or more certifications in information security (such as GCIA, GCIH, CEH, CISSP, SSCP, Sec+, etc).
• Sound cyber security knowledge foundation, to include understanding of: Strong understanding of Adversary TTPs, Network & Host Security.
• At least 5 years of Splunk and SIEM experience.
• At least 3 years of Trend spotting, identifying intelligence knowledge gaps, and performing analysis on threat data.
• High technical ability/aptitude, demonstrated through prior technical experience and accomplishment.
• At least 3 years of Endpoint/host forensics experience.
• Excellent verbal, written, and interpersonal skills (command of English language).
• Strong written and verbal skills to effectively communicate at all levels in government and industry.
• Exceptionally self-motivated, directed, and detail oriented.
• Must be able to learn, understand and apply new technologies.
• Excellent organizational, analytical and problem-solving abilities.
• Working knowledge of Microsoft Office (Outlook, Word, Excel, PowerPoint, Project, and SharePoint).
• At least 3 years of Experience in a rapid paced, time sensitive, high-quality environment.
• History of ethical performance.
• Exhibit considerable client delivery, business development, and proposal development experience.
• Strong management, teamwork, and interpersonal skills against difficult due dates and timelines.
• Strong customer service focus to meet the needs of internal and external customers.
• Professional, pleasant, and polished demeanor.
• Ability to work collaboratively with others.
• Ability to maintain confidentiality of sensitive information within and external to EdgeWater, using own judgment.
• Strong eye for small details that make a difference.

Nice To Haves

• Ten or more years of cyber security work experience in Threat Hunting, Splunk Content Development, and Incident Response.
• Active Public Trust clearance.
• Experience and effective participation in hunt, computer network defense, real-time analysis and incident response activities, to include ability to reconstruct events from network, endpoint, and log data.
• Experience and understanding of host-based/endpoint protection systems.

Responsibilities

• Maintain and operate Splunk application monitoring tool as part of the client Cybersecurity network and application audit and monitoring program within the Threat Monitoring and Incident Response (TMIR) team.
• Apply strategic, operational, and tactical cyber intelligence to improve security operations.
• Lead and/or support efforts to prepare for, monitor, detect, analyze/confirm, contain, remediate, and recover from security incidents.
• Develop & Implement Actionable Alerts and Workflow for Splunk as a CISO Monitoring tool.
• Develop and Implement Apps & Knowledge Objects (KO) like Dashboards, Reports, Data Models.
• Provide Analyst training and workshops on using Splunk.
• Develop and implement automation and efficiencies with Splunk.
• Communicate with customer stakeholders to include leadership, support teams, and system administrators.
• Conduct deep analysis and hunting operations.
• Configure incident response and remediation workflows for ES.
• Perform TMIR technical writing and creation of formal documentation such as reports, training material, and architecture diagrams.
• Develop and build excellent relationships with prospects, clients, and internal team members.
• Co-lead client calls and communications including the development of presentations, status reports, and requirements documents.
• Ability to take direction and achieve quality results, independently strive for personal excellence when completing tasks.

Benefits

• ISO 9001, 20000-1, 270001 certified
• Appraised at CMMI Level 3 Maturity for Development and Services
• Named in the Top Workplaces in the Greater Washington Area Small Companies since 2018
• Equal employment opportunities to all employees and applicants for employment without regard to race, color, religion, gender, sexual orientation, national origin, age, disability, marital status, veteran status, and/or other statuses protected by applicable law.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed