DETECTION AND AUTOMATION ENGINEER

Zermount, Inc; Arlington (VA); Hybrid; USD 110,000 - 150,000; Full time

Job summary

Zermount, Inc. is seeking a Detection and Automation Engineer to design, implement, and validate analytics, detections, dashboards, and automation for security operations center support.

The role combines hands-on engineering with disciplined validation, documentation, troubleshooting, and collaboration across analysts, threat hunters, intelligence personnel, platform engineers, and operational stakeholders.

Qualifications

• Experience building/testing security analytics and detections in enterprise SIEM
• Proficient in scripting/integrating with Python, PowerShell, APIs, JSON
• Experience testing capabilities, documenting work, troubleshooting production issues

Responsibilities

• Develop and document custom analytics, detections, dashboards, scripts, and automation playbooks
• Tune sensors, alerts, and analytics to reduce false positives and improve analyst workflows
• Translate threat intel and incident lessons into improved detection content and response logic
• Prototype and integrate approved technologies to address monitoring and reporting gaps
• Validate capabilities before operation and document results and dependencies
• Maintain automation and SOAR playbooks using approved tools
• Diagnose failed automation and restore or rollback functions with documentation
• Recommend improvements to SOC tools, workflows, content
• Support deployment and troubleshooting of security tools and sensors
• Maintain versioned content, tests, and training materials

Skills

Cybersecurity engineering

Detection engineering

Security analytics

SOC automation

Python scripting

PowerShell scripting

Education

Bachelor's degree in cybersecurity, computer science, software engineering, information systems, or a related field

Tools

Splunk SPL

Microsoft Sentinel KQL

Sigma

YARA

SOAR platforms

AWS CloudTrail

Azure Monitor

Microsoft 365 audit logs

GCIA

GCDA

GCED

Splunk

Microsoft Certifications

Job description

Detection and Automation Engineer

Position Overview

The Detection and Automation Engineer develops, tests, tunes, maintains, and documents the analytics, detections, dashboards, scripts, interfaces, and automation that support security monitoring and response. The role combines hands‑on engineering with disciplined validation, documentation, troubleshooting, and collaboration across analysts, threat hunters, intelligence personnel, platform engineers, and operational stakeholders.

Duties & Responsibilities

• Develop, test, maintain, and document custom analytics, detections, dashboards, scripts, interfaces, and automation playbooks.
• Tune sensors, rules, alerts, and analytics to improve fidelity, reduce false positives, and support efficient analyst workflows.
• Translate threat intelligence, hunt findings, incident lessons, and operational observations into improved detection content and response logic.
• Prototype and integrate approved technologies or custom capabilities needed to address monitoring, detection, response, or reporting gaps.
• Validate custom capabilities before operational use and document results, dependencies, limitations, configuration requirements, and maintenance considerations.
• Develop and maintain automation, orchestration, and response playbooks using approved tools and platforms.
• Diagnose and correct failed automation and workflows; safely restore or roll back affected functions and document corrective actions.
• Recommend targeted improvements to SOC tools, workflows, detections, dashboards, scripts, interfaces, and content.
• Support deployment, configuration, integration, and troubleshooting of security tools and sensors.
• Maintain version-controlled technical content, test cases, operating notes, and training materials for detections and automation.

Qualifications

Minimum Requirements:

• Three or more years of cybersecurity engineering, detection engineering, security analytics, or SOC automation experience.
• Experience developing or tuning security analytics in an enterprise SIEM or comparable monitoring platform.
• Experience scripting or integrating systems using Python, PowerShell, APIs, JSON, or comparable technologies.
• Experience testing security capabilities, documenting engineering work, and troubleshooting production issues.
• Ability to collaborate with analysts and stakeholders to translate operational needs into technical solutions.

Preferred Qualifications:

• Experience with Splunk SPL, Microsoft Sentinel KQL, Sigma, YARA, or comparable detection technologies.
• Experience developing playbooks in a SOAR or workflow-automation platform.
• Working knowledge of MITRE ATT&CK and practical detection-testing methods.
• Experience with cloud telemetry such as AWS CloudTrail, Azure Monitor, or Microsoft 365 audit logs.
• GCIA, GCDA, GCED, Splunk, Microsoft, CySA+, Security+, or comparable role-aligned certifications preferred.
• Experience supporting a 24x7 SOC where detection or automation failures have operational consequences.

What Success Looks Like

• Detection content is accurate, maintainable, testable, and tied to operational needs and observable data.
• Automation reduces manual effort without obscuring failure, creating unmanaged risk, or weakening analyst control.
• False positives, duplicate coverage, stale content, and broken workflows are identified and corrected promptly.
• Technical content and test evidence are sufficient for repeatable deployment, maintenance, and operational handoff.

Education and Certifications:

• Minimum: Bachelor's degree in cybersecurity, computer science, software engineering, information systems, or a related field; additional relevant experience may be considered in lieu of a degree

Clearance Level:

• Secret clearance preferred but not required.

Work Location

• Hybrid federal customer environment. Onsite work may be required for integration, testing, deployment, or customer-directed activities.

Hours of Operation

• Core business hours with participation in after-hours support for automation, detection, and workflow failures as assigned.

• Ability to pass a minimum background investigation.