Cybersecurity Detection Engineer — SIEM & Automation

Career Listings; Columbus (OH); On-site; USD 130,000 - 170,000; Full time

Job summary

SarelaTech is seeking a Cybersecurity Engineer to support the DLA CSSP program, focusing on enterprise cybersecurity detection capabilities and SIEM content development.

The role involves designing advanced threat detection use cases, automating security processes, and enhancing monitoring across government environments, with collaboration across government stakeholders and cyber operations teams.

Qualifications

• Active DoD Top Secret clearance with SCI eligibility and IT-I access.
• Bachelor's degree or equivalent experience in a related field.
• Minimum five years of IT experience; minimum three with a SIEM in content development, threat detection, or IR.
• Experience developing SIEM correlation rules, threat detection content, or analytics using SPL and KQL.

Responsibilities

• Research, develop, and implement new cybersecurity threat detection use cases based on threats and threat intel.
• Design, develop, and maintain SIEM correlation rules, analytics, dashboards, and detection content.
• Develop automation scripts using PowerShell or Python to enhance SIEM functionality.
• Analyze log sources and data quality to improve visibility and event collection.
• Collaborate with government stakeholders and ops teams to identify critical systems and monitoring needs.
• Evaluate architectures and telemetry to identify deficiencies and improve detection capabilities.
• Support MITRE ATT&CK-aligned methodologies and Defense-in-Depth practices.
• Prepare technical documentation and engineering recommendations for tool enhancements.

Skills

Strong written and verbal comms

SIEM content development

Threat detection engineering

PowerShell scripting

Python scripting

SPL

KQL

Enterprise network architecture

Log analysis

Education

Bachelor's degree in Cybersecurity/IT/CS/CE or related field

DoD 8570 IAT Level II certification

DoD CSSP certification (CSSP-IR/CSSP-A)

GIAC certifications (optional)

Tools

Splunk Enterprise Security

Job description

SarelaTech is seeking a Cybersecurity Engineer to support the DLA CSSP program, focusing on enterprise cybersecurity detection capabilities and SIEM content development.

The role involves designing advanced threat detection use cases, automating security processes, and enhancing monitoring across government environments, with collaboration across government stakeholders and cyber operations teams.