Senior Detection Engineer

SAIC•Oak Ridge, TN

11h

About The Position

SAIC is hiring a Senior Detection Engineer to serve as a Senior Technical Analyst within its Enterprise Security Operations Center (ESOC) and Detection Engineering Team. The role enhances enterprise-wide threat detection by developing high-fidelity detections on an operational cadence across SIEM, EDR, and other security telemetry platforms. The analyst works closely with Detection and Response, Cyber Incident Response, Cyber Threat Intelligence, Offensive Security Operations, and Sustainment teams to operationalize detections and strengthen the organization’s defensive posture. The Senior Analyst also mentors Detection Engineering analysts and collaborates across teams on capability development, detection tuning, and documentation improvements. The role contributes to continuous improvement initiatives and cross-team knowledge sharing aligned with ESOC and Defensive Cyber Operations objectives. The position is based in Oak Ridge, Tennessee, with remote work available for qualified candidates. The schedule is 4×10, 7:00 a.m.–5:00 p.m. EST, Monday through Thursday, with support for 24/7/365 operations when required.

Requirements

Bachelor’s degree and at least 5 years of related experience, or a master’s degree and at least 3 years of related experience; an additional 4+ years of experience may be considered in lieu of a degree.
At least 3 years of cybersecurity operations experience working with the enterprise SIEM Splunk.
Must possess CySA+, SSCP, or an equivalent certification.
Must obtain the Splunk Certified Cybersecurity Defense Engineer certification within six months of hire.
Advanced proficiency in Splunk SPL and Python for security automation and workflow development.
Strong leadership skills and the ability to lead and motivate a team.
Can-do attitude.
Self-motivated and quick to learn.
Excellent verbal and written communication skills.
Ability to multitask and collaborate to solve complex technical problems.

Nice To Haves

One or more of the following certifications: ISC2 CISSP, Splunk Certified Cybersecurity Defense Analyst, or Splunk Certified Cybersecurity Defense Engineer.

Responsibilities

Develop, deploy, and maintain high-fidelity detections across SIEM, EDR, and other security telemetry platforms.
Work with the Detection and Response team to validate alerts, refine workflows, and align detections with operational needs and analyst workflows.
Provide rapid detection-focused support during active incidents, including tuning recommendations, data enrichment, and technical guidance.
Tune and optimize detections to improve fidelity, reduce false positives, increase efficiency, and close enterprise visibility gaps.
Analyze threats and telemetry to verify detection performance, identify adversary behaviors, and maintain coverage of emerging threats.
Translate cyber threat intelligence, including TTPs, indicators, and behavioral patterns, into actionable detections aligned with mission requirements.
Partner with Cyber Threat Intelligence, Offensive Security Operations, and Purple-Team operators to validate detection logic through adversary emulation and exercises, and address monitoring gaps.
Turn threat-hunting discoveries, vulnerability insights, and Purple-Team findings into improved detection logic, analytics, and monitoring.
Document detection logic, tuning actions, workflows, and operational standards.
Mentor Detection Engineering analysts and support the development of Detection and Response personnel.
Contribute to ESOC and DCO improvement initiatives, including engineering sprints, automation, detection content onboarding, and process refinement.
Lead post-incident detection reviews to identify root-cause gaps, update detection coverage, and improve defensive posture.
Enhance ESOC dashboards, analytics, and tooling for monitoring, triage, and investigations.
Support 24/7/365 ESOC operational needs as required, including during high-priority or elevated-tempo events.
Perform additional duties and operational tasks as assigned.