Cyber Analytics Engineer III

RISA; St. Louis (MO); On-site; USD 78,000 - 86,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) and Roth

Paid Time Off

11 federal holidays

Equal Opportunity Employer

Job summary

RISA is hiring a Cyber Threat Detection Engineer (SIEM / Signatures) in St. Louis, MO on site. You will develop and tune detection logic, run Purple Team exercises, and collaborate with the Cyber Data Analytics team to improve SIEM efficiency.

The role requires active TS/SCI clearance, U.S. citizenship, and the ability to obtain a government polygraph post-hire. Bachelor's degree with 6+ years of relevant experience is expected.

Qualifications

• 8+ years of related advanced cyber security analytics experience.
• Certification compliant with DoD 8140.01 and 8570.01-M IAT Level III and CSSP Analyst.
• Data mining or query building in a SIEM.
• Strong signature development and tuning, and strong network protocol analysis.

Responsibilities

• Analyze trends and patterns to identify and predict events, then develop or tune rules, signatures, and scripts.
• Turn intelligence and incident reporting into deployed detection logic.
• Run regular Purple Team exercises and validate countermeasures.
• Work with the Cyber Data Analytics team on SIEM alert efficiency, evaluating valid alerts vs false positives.
• Support the Cyber Incident Response Team during live activity, predicting adversary response and locations of compromise to aid triage.
• Document work in the authorized ticketing system so stakeholders can reconstruct the analysis.

Skills

Cyber analytics

SIEM tuning

Signature development

Regex proficiency

Education

Bachelor's degree + 6 years experience

Tools

Python scripting

PowerShell scripting

Bash scripting

Job description

Cyber Threat Detection Engineer (SIEM / Signatures)

Location: St. Louis, MO - on site

Time Type: Full time, Exempt

Clearance Required to Start: Active TS/SCI (U.S. citizenship required)

Additional Requirement: Must be able to obtain and maintain a Government polygraph (post-hire requirement)

Travel: None

Salary Range: $78,000 – $86,000

Adversaries are already inside somebody's enterprise. Make sure it isn't this one.

RISA is hiring an advanced cybersecurity analytics specialist to develop and maintain the defensive countermeasures protecting an Intelligence Community customer's enterprise. You will work in a Fusion model alongside Focused Operations under Defensive Cyber Operations. This is hunt and detection engineering, not queue-clearing: you write and tune the logic that prevents a compromise and evicts adversaries who are already persistent. You will talk to the owner here, not a recruiting queue.

What You Will Do

• Analyze trends and patterns to identify and predict previously undiscovered events, then develop or tune the rules, signatures, and scripts that catch them.


• Turn intelligence and incident reporting into deployed detection logic.


• Run regular Purple Team exercises and continuously validate countermeasures already deployed.


• Work with the Cyber Data Analytics team on SIEM alert efficiency, evaluating valid alerts against false positives.


• Support the Cyber Incident Response Team during live activity, predicting adversary response and locations of compromise to assist triage.


• Document work in the authorized ticketing system so any stakeholder can reconstruct the analysis.

What You'll Bring

• U.S. citizenship and an active TS/SCI.


• Ability to successfully obtain and maintain a Government polygraph after hire.


• Education and experience, per the contract labor category criteria: Bachelor's degree in a field applicable to the position plus 6 years of relevant experience. Equivalents accepted - Master's plus 4, Associate's plus 8, or High School diploma/GED plus 10.


• 8+ years of related advanced cyber security analytics experience.


• A certification compliant with DoD 8140.01 and 8570.01-M IAT Level III and CSSP Analyst.


• Data mining or query building in a SIEM.


• Strong signature development and tuning, and strong network protocol analysis with protocol analyzers.


• Static file signatures (magic numbers) and good working knowledge of regular expressions.

Nice to Have

• Hex editor comfort; Python, Bash, or PowerShell scripting.


• Purple Team tactics; cloud security - visibility gaps, data lakes, and data mining.

About RISA

Rolston Information Systems Assurance (RISA) is a Service-Disabled Veteran-Owned Small Business that has supported federal defense and intelligence cybersecurity missions for more than seventeen years. We are small on purpose: direct access to leadership, a real say in how the work gets done, and none of the layers that slow large primes down.

Benefits

Medical, dental, and vision insurance; 401(k) and Roth; Paid Time Off; and 11 paid Federal Holidays.

RISA is an Equal Opportunity Employer.