Detection Engineer

Rootedsec; Reston (VA); Hybrid; USD 115,000 - 145,000; Full time

Job summary

CACI International in Reston, VA is seeking a Detection Engineer to translate attacker techniques into production detection rules and to monitor security telemetry on real production data. You will build detections from real attacker behavior, measure false positives, and hunt for gaps that current detections would miss.

The role requires strong query and scripting skills, knowledge of attacker techniques, and willingness to manage, retire, or improve rules as needed.

Qualifications

• Knows what attacks look like in telemetry, not just in theory.
• Query languages and a scripting language.
• Willin g to delete your own rules when they stop earning their place.

Responsibilities

• Build detections from real attacker behaviour.
• Measure each rule's false positive rate and own it.
• Hunt for what current detections would have missed.

Skills

Threat detection

Query languages

Scripting

Rule management

Tools

Sigma rules

Job description

# Detection EngineerReston, Virginia· ONSITEHacker+ signal## CACI InternationalWrite and maintain the rules that identify attacks in security monitoring data.Type: FULLTIMERange: USD 115.000 – 145.000 per yearMode: ONSITEMinimum rank: Hacker## About the roleYou translate known attacker techniques into detection rules that work against real production data. The difficulty is not writing a rule that fires on a test case; it is writing one that still identifies the technique months later while producing few enough false positives that the on-call team can trust it. You also run threat hunts to find activity that current detections would have missed.### What you will do* Build detections from real attacker behaviour* Measure each rule's false positive rate and own it* Hunt for what current detections would have missed### What they ask for* Knows what attacks look like in telemetry, not just in theory* Query languages and a scripting language* Willing to delete your own rules when they stop earning their place### Nice to have* Purple team experience* Sigma rules* Incident response background## What applying with Rooted meansThis role accepts applications with Rooted context. Instead of sending only a resume, you can attach a verifiable credential with your proofs, rank, and technical evidence.Your application includes your Rooted credential: rank, verified proofs, and supporting evidence.You can read this role without an account. To apply you need a Rooted credential.Create Professional profileSee every open security roleThis role is curated by Rooted. Rooted is not the hiring company unless explicitly stated. The hiring company is CACI International. Confirm the final details with the original source or during the application process.Posted 2026-08-13