Detection Engineer (SIEM/SOAR)

Dragonfli Group • Washington, DC

2d

About The Position

Dragonfli Group is seeking a Detection Engineer to join the Detection and Automation Engineering (DAE) program within the security operations organization of a large federal agency. The role focuses on designing, implementing, and maintaining automated and AI-driven security detection and integration capabilities across enterprise security monitoring technologies. The engineer will turn operational security needs into working detections and workflows using SIEM, EDR, SOAR, threat intelligence platforms, and scripting tools. The position involves close coordination with SOC, threat intelligence, and incident response teams, as well as documentation and operationalization to sustain reliable detections over time. This is a multi-year contract supporting a large U.S. federal agency. U.S. citizenship or permanent residency is required, and all work must be performed within the continental United States.

Requirements

• The posting’s overview calls for 8+ years of relevant cybersecurity experience in detection engineering, security operations, or a closely related field; the Must-Have section separately lists 3–8+ years of relevant experience.
• Bachelor’s degree in a relevant field, or four additional years of relevant experience in lieu of a degree.
• U.S. citizenship or permanent residency; all work must be performed within the continental U.S.
• CompTIA Security+ or equivalent baseline certification.
• One of GCIA, GCIH, or CompTIA CySA+.
• Programming/scripting certification or demonstrated proficiency in Python, PowerShell, or a similar language.
• Hands-on experience with SIEM and SOAR platforms, such as Splunk Enterprise Security, Splunk SOAR, SentinelOne, and SentinelOne Hyperautomation.
• Working knowledge of detection engineering methodologies, SOC operations, and incident response.
• Working knowledge of NIST SP 800-53, CIS Controls, and the MITRE ATT&CK framework.
• Experience creating and maintaining technical documentation, SOPs, and runbooks.
• Technical skills include API integration and development; threat intelligence lifecycle and analysis; network protocols and architecture; Windows, Linux, and Unix; AWS, Azure, and GCP; security architecture and design; and security telemetry and data analysis.
• Clear technical writing, cross-functional collaboration, requirements analysis, analytical problem solving, a continuous-improvement mindset, and initiative in evaluating emerging security and AI/ML capabilities.

Nice To Haves

• CISSP or GIAC Security Essentials (GSEC).
• CompTIA SecAI+.
• GMON or a similar continuous monitoring/detection-focused certification.
• Prior federal contracting experience.
• Familiarity with the NICE Framework, ISO 27001/27002, FISMA, FedRAMP, OMB circulars and federal cybersecurity directives, and the Privacy Act.
• Experience with malware analysis, digital forensics procedures, and risk assessment methodologies.
• Experience applying machine learning and AI to security detection.

Responsibilities

• Build automation, AI-driven (“Super Intelligence”/SI), and integration workflows to improve detection and response.
• Integrate and optimize SIEM, EDR, SOAR, and threat intelligence technologies into a cohesive detection architecture.
• Analyze requirements and translate operational security needs into technical specifications and implementable solutions.
• Test, evaluate, and validate detections and automation workflows, and drive continuous improvement based on results and operational feedback.
• Analyze security telemetry to identify anomalies, trends, and detection gaps, then recommend and implement detection enhancements.
• Create and maintain technical documentation, SOPs, and runbooks that support reliable operations.
• Coordinate with SOC, threat intelligence, and incident response teams to align detections with threat priorities and operational processes.
• Research and assess emerging security and AI/ML capabilities that can enhance detection effectiveness.

Benefits

• Medical coverage with multiple POS health plan options, including an HSA-compatible plan.
• Dental PPO coverage for preventive, basic, and major services.
• Vision coverage including an annual exam, frames, lenses, and a contact lens allowance.
• 401(k) with employer match up to 5% of eligible compensation.
• Long-term disability coverage, 100% employer-paid, at 50% of pre-disability earnings.
• Life insurance and AD&D coverage, 100% employer-paid and valued at $10,000 each.
• 15–25 days of PTO annually based on tenure.
• All 11 federal holidays observed as paid holidays.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior