SIEM Content Developer (Ohio)

Markesman Group • Whitehall, OH

3d

About The Position

The SIEM Content Developer researches and develops threat-detection use cases based on emerging threats and cyber threat intelligence. The role develops SIEM detection content in response to feedback from Incident Response and Threat Detection analysts, identifies gaps in security monitoring, protection, and analytics, and improves SIEM data ingestion and detection content.

The position also develops and maintains custom scripts, reviews the quality and effectiveness of security data feeds, establishes alerting priorities for critical systems and applications, and creates signatures and detection logic tailored to individual programs and applications. The developer collaborates with cybersecurity tool subject-matter experts, engineers, analysts, and mission stakeholders; analyzes network architecture and log sources to develop detection strategies; maps detection content and adversary behavior to MITRE ATT&CK; and supports Defense-in-Depth through improved enterprise detection capabilities.

Requirements

• At least 5 years of relevant IT experience.
• At least 3 years working with a SIEM in a content-development or Incident Response role.
• At least 3 years of System Administration and/or Network Administration experience.
• Understanding of various log formats.
• Understanding of the MITRE ATT&CK framework.
• Strong understanding of network architecture.
• Experience developing and maintaining scripts.
• Understanding of Defense-in-Depth.
• Current DoD Top Secret clearance.
• Eligible for IT-I Critical Sensitive / Tier 5 (T5) at proposal submission.

Nice To Haves

• Scripting experience with PowerShell, Python, or SPL is preferred.

Responsibilities

• Research and develop new threat-detection use cases based on emerging threats and cyber threat intelligence.
• Develop SIEM detection content based on feedback from Incident Response and Threat Detection analysts.
• Identify gaps in security monitoring, protection, and analytics capabilities.
• Develop and maintain custom scripts to enhance SIEM functionality.
• Review the quality and effectiveness of security data feeds.
• Recommend and implement improvements to SIEM data ingestion and detection content.
• Develop alerting priorities for critical systems and applications.
• Create signatures and detection logic tailored to individual programs and applications.
• Collaborate with cybersecurity tool SMEs, engineers, analysts, and mission stakeholders.
• Analyze network architecture and log sources to develop appropriate detection strategies.
• Map detection content and adversary behavior to MITRE ATT&CK.
• Support Defense-in-Depth through improved enterprise detection capabilities.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed