Cyber Threat Detection Engineer III - SIEM Signatures

RISA; St. Louis (MO); On-site; USD 78,000 - 86,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) and Roth

Paid Time Off

11 federal holidays

Equal Opportunity Employer

Job summary

RISA is hiring a Cyber Threat Detection Engineer (SIEM / Signatures) in St. Louis, MO on site. You will develop and tune detection logic, run Purple Team exercises, and collaborate with the Cyber Data Analytics team to improve SIEM efficiency.

The role requires active TS/SCI clearance, U.S. citizenship, and the ability to obtain a government polygraph post-hire. Bachelor's degree with 6+ years of relevant experience is expected.

Qualifications

• 8+ years of related advanced cyber security analytics experience.
• Certification compliant with DoD 8140.01 and 8570.01-M IAT Level III and CSSP Analyst.
• Data mining or query building in a SIEM.
• Strong signature development and tuning, and strong network protocol analysis.

Responsibilities

• Analyze trends and patterns to identify and predict events, then develop or tune rules, signatures, and scripts.
• Turn intelligence and incident reporting into deployed detection logic.
• Run regular Purple Team exercises and validate countermeasures.
• Work with the Cyber Data Analytics team on SIEM alert efficiency, evaluating valid alerts vs false positives.
• Support the Cyber Incident Response Team during live activity, predicting adversary response and locations of compromise to aid triage.
• Document work in the authorized ticketing system so stakeholders can reconstruct the analysis.

Skills

Cyber analytics

SIEM tuning

Signature development

Regex proficiency

Education

Bachelor's degree + 6 years experience

Tools

Python scripting

PowerShell scripting

Bash scripting

Job description

RISA is hiring a Cyber Threat Detection Engineer (SIEM / Signatures) in St. Louis, MO on site. You will develop and tune detection logic, run Purple Team exercises, and collaborate with the Cyber Data Analytics team to improve SIEM efficiency.

The role requires active TS/SCI clearance, U.S. citizenship, and the ability to obtain a government polygraph post-hire. Bachelor's degree with 6+ years of relevant experience is expected.