Detection Engineer

accenturefederalservices; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Accenture Federal Services is seeking a seasoned Cyber Incident Detection Engineer to design and implement detection capabilities across SIEM and network security platforms. You will develop content, tune rules, and collaborate with cross-team stakeholders to strengthen Federal cyber defense.

You will work with Microsoft Sentinel, Cisco FirePower, and IDS/IPS, writing and optimizing KQL queries, managing code in Git/GitHub, and aligning designs with NIST/ CISA guidance while communicating

Qualifications

• U.S. citizenship and a Bachelor's degree in Cybersecurity, CS, or related field, or equivalent experience.
• 6+ years in information security with 2+ years of event and log analysis across AV, IDS/IPS, firewalls, Active Directory, web proxies, DLP, and SIEM.
• At least 1 year of hands-on Microsoft Sentinel and KQL experience, plus 1 year configuring Cisco FirePower and IDS/IPS.
• Practical detection engineering skills, including signature design and tuning for IoCs and IoAs.
• Packet and malware analysis using tools such as Wireshark, along with scripting in PowerShell, Python, regex, grep, sed, or awk.
• Strong grounding in TCP/IP, application-layer protocols, Windows/Linux internals, and the MITRE ATT&CK framework.

Responsibilities

• Design, engineer, and implement detection initiatives under a cybersecurity team lead, including AI-assisted tooling where applicable.
• Develop and tune detection logic for Microsoft Sentinel, Cisco FirePower, IDS/IPS, and adjacent network security platforms, mapping rules to MITRE ATT&CK.
• Author and optimize KQL queries for Sentinel, reducing false positives and improving fidelity of security-relevant events handed to triage and response teams.
• Manage detection code in Git and GitHub, using version control and collaborative workflows for auditability.
• Translate findings between network engineering and cybersecurity teams, advocating for secure designs and briefing stakeholders on architecture and strategy.
• Recommend improvements that align with federal and industry standards such as NIST and CISA guidance.

Skills

Detection engineering

Packet and malware analysis

Scripting: PowerShell and Python

Education

Bachelor's degree in Cybersecurity/CS or related field

Tools

Microsoft Sentinel

Cisco FirePower

Git & GitHub

KQL

Job description

Role overview

This position supports a federal Cyber Incident Response Team, designing and engineering detection capabilities across SIEM and network security platforms. The work blends hands-on detection content development with cross-team collaboration to improve an organization's overall security posture against sophisticated threats.

Responsibilities

• Design, engineer, and implement detection initiatives under a cybersecurity team lead, including AI-assisted tooling where applicable.
• Develop and tune detection logic for Microsoft Sentinel, Cisco FirePower, IDS/IPS, and adjacent network security platforms, mapping rules to frameworks such as MITRE ATT&CK.
• Author and optimize KQL queries for Sentinel, reducing false positives and improving fidelity of security-relevant events handed to triage and response teams.
• Manage detection code in Git and GitHub, using version control and collaborative workflows for auditability.
• Translate findings between network engineering and cybersecurity teams, advocating for secure designs and briefing stakeholders on architecture and strategy.
• Recommend improvements that align with federal and industry standards such as NIST and CISA guidance.

Requirements

• U.S. citizenship and a Bachelor's degree in Cybersecurity, Computer Science, or a related field, or equivalent experience.
• 6+ years in information security, including 2+ years of event and log analysis across AV, IDS/IPS, firewalls, Active Directory, web proxies, DLP, and SIEM.
• At least one year of hands-on Microsoft Sentinel and KQL experience, plus one year configuring Cisco FirePower and IDS/IPS.
• Practical detection engineering skills, including signature design and tuning for IoCs and IoAs.
• Packet and malware analysis using tools such as Wireshark, along with scripting in PowerShell, Python, regex, grep, sed, or awk.
• Strong grounding in TCP/IP, application-layer protocols, Windows/Linux internals, and the MITRE ATT&CK framework.

Nice to have

• Threat hunting and security automation experience.
• Familiarity with cloud security monitoring in Azure or AWS.
• Certifications such as GIAC GCIA, GCED, or Microsoft Security Operations Analyst Associate.

Benefits and work setup

• U.S.-based federal services role with disclosed compensation ranges tied to specific state labor markets; benefits package referenced by the employer.