Detection and Response Engineer

United States Digital Space LLC; United States; Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Paid parental leave

Certification reimbursement

Digital mental health support

Comprehensive insurance options

Job summary

United States Digital Space LLC seeks an experienced Detection and Response Engineer to join its Defensive Services team. You will support SIEM monitoring, threat hunting, and purple team activities to help clients meet federal compliance and security requirements.

You will develop detection logic across multiple SIEM platforms, tune alerts for fidelity, and lead hypothesis-driven threat hunts using threat intelligence and behavior-based analytics.

Qualifications

• 2–4 years of experience in large‑scale enterprise security environments (cloud or hybrid).
• Working knowledge of at least one major cloud platform (Azure, AWS, or GCP).
• Hands-on experience with two or more SIEM platforms in a production setting.
• Experience monitoring, validating, and escalating SIEM alerts per runbooks and SLAs.
• Ability to investigate security alerts and determine scope, root cause, and impact.

Responsibilities

• Collect, analyze, and operationalize threat intelligence to inform threat hunting and detection improvements.
• Develop and tune queries across SIEM platforms; build dashboards and searches for repeatable use cases.
• Lead periodic threat hunts and translate outcomes into improved detections, alerts, and runbooks.

Skills

Threat hunting

SIEM operation

Incident response

Threat intelligence

MITRE ATT&CK mapping

Detection-as-Code

Cloud monitoring

Communication skills

Documentation

Analytical reasoning

Tools

Splunk

Microsoft Sentinel

ELK

Sumo Logic

Job description

About the company

the company is on a mission to make the world a safer place by solving our clients’ hardest cybersecurity challenges. We work at the cutting edge of technology to advise, assess, automate, and ultimately help companies navigate the ever-changing cybersecurity landscape. We are headquartered in Chicago, Illinois with offices across the U.S. and U.K., and we support clients around the world.

But that’s not who we are – that’s just what we do.

We are thought leaders, consultants, and cybersecurity experts, but above all else, we are a team of passionate problem-solvers who are hungry to learn, grow, and make a difference.

Why Join Us

We are seeking a Detection and Response Engineer to join our Defensive Services team, supporting SIEM monitoring and alerting, threat hunting, and purple team activities that help our clients meet both federal compliance and commercial security requirements. If you're passionate about defending organizations against evolving threats, driven to innovate, and thrive in a collaborative, high-performing environment, we'd love to have you on our team. Join us in our mission to make the world a safer place through proactive cybersecurity and operational excellence.

What You'll Do

• Collect, analyze, and operationalize threat intelligence to inform proactive detection and threat‑hunting activities, driving measurable security posture improvements across client environments.
• Develop, optimize, and maintain custom detection and threat‑hunting queries across two or more SIEM platforms, tuning alerts for improved fidelity and building dashboards and saved searches that support repeatable, operational use cases.
• Plan and lead cyclical, hypothesis‑driven threat hunts using threat intelligence and behavior‑based analytics; identify detection gaps and telemetry blind spots, and translate hunt outcomes into detection improvements, alert tuning, and updated runbooks.

What You'll Bring

• 2–4 years of experience operating within large‑scale enterprise security environments, including exposure to cloud‑hosted or hybrid infrastructures.
• Foundational working knowledge of at least one major cloud platform (Azure, AWS, or GCP) and how cloud telemetry is leveraged for security monitoring and investigations.
• Hands‑on experience with at least two SIEM platforms (e.g., Splunk, Microsoft Sentinel, ELK, LogRhythm, or Sumo Logic) in a production detection and response environment.
• Experience independently monitoring, validating, and escalating SIEM alerts in accordance with documented runbooks, SLAs, and severity thresholds.
• Proven ability to independently investigate and respond to security alerts, performing deep‑dive analysis across multiple log sources to determine scope, root cause, and impact.
• Experience escalating confirmed or high‑confidence incidents with clear timelines, evidence, and MITRE ATT&CK mapping to Incident Response teams or senior engineers.
• Experience conducting structured and cyclical threat‑hunting activities using hypothesis‑driven and behavior‑based methodologies.
• Ability to leverage threat intelligence to understand threat actor tradecraft, attack chains, and expected telemetry, and apply that knowledge to investigations and hunts.
• Hands‑on experience developing, optimizing, and maintaining custom detection and threat‑hunting queries in at least two SIEM platforms, and translating investigative requirements into performant, reusable query logic.
• Experience identifying detection gaps, telemetry blind spots, and data quality issues, and translating findings into alert tuning, new detection logic, dashboards, and updated runbooks or SOPs.
• Excellent communication, organizational, and problem‑solving skills, with the ability to convey complex technical information clearly.
• Strong documentation skills for creating technical diagrams, written descriptions, and other supporting materials.
• Demonstrated ability to work both independently and as a member of a team, maintaining a professional attitude and demeanor.
• Critical thinking skills to balance robust security requirements against mission objectives.
• Proven track record of adapting quickly and efficiently in fast‑paced, dynamic environments.
• Experience utilizing a Detection‑as‑Code framework
• Experience working with NIST 800‑53 environments

REQUIRED CERTIFICATIONS:

At least one of the following:

• Splunk Enterprise Certified Administrator
• Splunk Enterprise Security Certified Administrator
• SumoLogic Administrator
• Microsoft Security Operations Associate
• Elastic Stack Certified Administrator

Bonus Points

• Professional services background: Prior experience supporting external clients from within a consulting or professional services organization.
• Automation capabilities: Experience automating workflows in GitLab or GitHub with Terraform and Ansible.
• Compliance frameworks: Understanding of FedRAMP, FISMA, HIPAA, HITRUST, PCI, and similar regulatory standards.

The salary range listed is a reasonable estimate of the compensation range for this role based on national salary averages. The actual salary offer to the successful candidate will be based on job‑related education, geographic location, training, licensure and certifications and other factors. You may also be eligible to participate in annual incentive, commission, and/or recognition programs.

Why You’ll Want to Join Us

At the company, you’ll find the support you need to thrive personally and professionally. In many cases, we provide a flexible work model that empowers you to choose when and where you’ll work most effectively – whether you’re at home or an office.

Regardless of location, you’ll experience a company that prioritizes connection and wellbeing and be part of a team where people care about each other and our communities. You’ll have opportunities to join employee resource groups, participate in in‑person and virtual events, and more. And you’ll enjoy competitive perks and benefits to support you and your family, like paid parental leave, flexible time off, certification and training reimbursement, digital mental health and wellbeing support membership, and comprehensive insurance options.

At the company, equal opportunity and pay equity is integral to the way we do business. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran. the company is committed to providing access, equal opportunity, and reasonable accommodation for individuals with disabilities in employment, its services, programs, and activities. To request reasonable accommodation to participate in the job application or interview process, contact our Human Resources team at [e-mail].

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as analyzing resumes, or assessing responses. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.