Senior Detection Engineer

SAIC•Remote Work, TN

3d•Remote

About The Position

SAIC is hiring a Senior Detection Engineer to serve as a Senior Technical Analyst within its Enterprise Security Operations Center (ESOC) and Detection Engineering Team. The position is based in Oak Ridge, Tennessee, with remote work available for qualified candidates. Reporting to the Manager of Defensive Cyber Operations (DCO), this role enhances enterprise-wide threat detection capabilities by developing and maintaining high-fidelity detections across SIEM, EDR, and other security telemetry platforms. The analyst works closely with Detection and Response, Cyber Incident Response, Cyber Threat Intelligence, Offensive Security Operations, and Sustainment teams to operationalize detections and strengthen the organization’s defensive posture. The position also mentors Detection Engineering analysts and collaborates across teams on capability development, detection tuning, documentation, and continuous improvement. The schedule is 4×10, 7:00 a.m. to 5:00 p.m. EST, Monday through Thursday, with support for 24/7/365 operations as required. The role is remote-capable for qualified candidates and requires no clearance. SAIC lists a target salary range of $60,001–$100,000, dependent on experience and other factors.

Requirements

Bachelor’s degree and at least 5 years of related experience, or a master’s degree and at least 3 years of related experience; an additional 4 or more years of experience may be considered in lieu of a degree.
At least 3 years of cybersecurity operations experience working with the enterprise SIEM Splunk.
Must possess CySA+, SSCP, or an equivalent certification.
Must obtain the Splunk Certified Cybersecurity Defense Engineer certification within six months of hire.
Advanced proficiency in Splunk SPL and Python for security automation and workflow development.
Strong leadership skills and a proven ability to lead and motivate a team.
Self-motivated, quick to learn, and able to maintain a can-do attitude.
Excellent verbal and written communication skills.
Ability to multitask and collaborate to solve complex technical problems.

Nice To Haves

ISC2 CISSP certification.
Splunk Certified Cybersecurity Defense Analyst certification.
Splunk Certified Cybersecurity Defense Engineer certification is listed as desirable; it is also required within six months of hire.

Responsibilities

Develop, deploy, and maintain high-fidelity detections across SIEM, EDR, and other security telemetry platforms.
Work with the Detection and Response team to validate alerts, refine workflows, and align detections with operational needs and analyst workflows.
Provide rapid detection-focused support during active incidents, including tuning recommendations, data enrichment, and technical guidance.
Tune and optimize detections to improve fidelity and efficiency, reduce false positives, and close enterprise visibility gaps.
Analyze threats and telemetry to confirm detection performance, identify adversary behaviors, and ensure coverage of emerging threats.
Translate cyber threat intelligence, including TTPs, indicators, and behavioral patterns, into actionable detections aligned with DCO mission requirements.
Partner with Cyber Threat Intelligence, Offensive Security Operations, and Purple-Team operators to validate detection logic through adversary emulation and identify monitoring gaps.
Convert threat-hunting discoveries, vulnerability insights, and purple-team findings into improved detection logic, analytics, and monitoring enhancements.
Document detection logic, tuning actions, workflows, and operational standards.
Mentor Detection Engineering analysts and support the development of Detection and Response personnel.
Contribute to ESOC/DCO improvement initiatives, including engineering sprints, automation, detection-content onboarding, and process refinement.
Lead post-incident detection reviews, identify root-cause gaps, and improve detection coverage.
Enhance ESOC dashboards, analytics, and tooling for monitoring, triage, and investigations.
Support ESOC 24/7/365 operational needs during high-priority or elevated-tempo events as required.
Perform additional duties and operational tasks as assigned.