Senior Detection Engineer

SAIC•Flexwork, TN

About The Position

SAIC is hiring a Senior Detection Engineer to serve as a Senior Technical Analyst on its Enterprise Security Operations Center (ESOC) Detection Engineering Team. The position is based in Oak Ridge, Tennessee, with remote work available for qualified candidates. Reporting to the Manager of Defensive Cyber Operations (DCO), the role enhances enterprise-wide threat detection by developing and maintaining high-fidelity detections across SIEM, EDR, and other security telemetry platforms. The analyst works with Detection and Response, Cyber Incident Response, Cyber Threat Intelligence, Offensive Security Operations, and Sustainment teams to operationalize detections and strengthen the organization’s defensive posture. The role also mentors Detection Engineering analysts, supports capability development, detection tuning, documentation improvements, and cross-team knowledge sharing. The position follows a 4×10 schedule, 7:00 a.m.–5:00 p.m. EST, Monday through Thursday, with support for 24/7/365 operations when required.

Requirements

Bachelor’s degree and 5+ years of related experience, or a Master’s degree and 3+ years of related experience; an additional 4+ years of experience may be considered in lieu of a degree.
At least 3 years of cybersecurity operations experience working with the enterprise SIEM Splunk.
Must possess CySA+, SSCP, or an equivalent certification.
Must obtain the Splunk Certified Cybersecurity Defense Engineer certification within six months of hire.
Advanced proficiency in Splunk SPL and Python for security automation and workflow development.
Strong leadership skills and demonstrated ability to lead and motivate a team.
Can-do attitude.
Self-motivated and quick learner.
Excellent verbal and written communication skills.
Ability to multitask and collaborate to solve complex technical problems.

Nice To Haves

One or more of the following certifications: ISC2 CISSP, Splunk Certified Cybersecurity Defense Analyst, or Splunk Certified Cybersecurity Defense Engineer.

Responsibilities

Develop, deploy, and maintain high-fidelity detections across SIEM, EDR, and other security telemetry platforms.
Work with the Detection and Response team to validate alerts, refine workflows, and align detections with operational needs and analyst workflows.
Provide rapid detection-focused support during active incidents, including tuning recommendations, data enrichment, and technical guidance.
Tune and optimize detections to improve fidelity, reduce false positives, strengthen efficiency, and address enterprise visibility gaps.
Analyze threats and telemetry to confirm detection performance, identify adversary behaviors, and maintain coverage of emerging threats.
Translate Cyber Threat Intelligence (CTI), including TTPs, indicators, and behavioral patterns, into actionable detections aligned with DCO requirements.
Partner with CTI, Offensive Security Operations, and Purple-Team operators to validate detection logic through adversary emulation and identify monitoring gaps.
Convert threat-hunting discoveries, vulnerability insights, and purple-team findings into improved detection logic, analytics, and monitoring enhancements.
Document detection logic, tuning actions, workflows, and operational standards.
Mentor Detection Engineering analysts and support the development of Detection and Response personnel.
Contribute to ESOC/DCO improvement initiatives, including engineering sprints, automation, detection content onboarding, and process refinement.
Lead post-incident detection reviews to identify root-cause gaps, update detection coverage, and improve defensive posture.
Enhance ESOC dashboards, analytics, and tooling for monitoring, triage, and investigative operations.
Support ESOC 24/7/365 operational needs during high-priority or elevated-tempo events.
Perform additional duties and operational tasks as assigned.