Detection Engineer Analyst – TS/SCI Eligible | SIEM/SOAR

Resource Management Concepts, Inc.; Quantico (VA); In loco; USD 120.000 - 140.000; Tempo pieno

Vantaggi offerti da questo lavoro

Relocation assistance

Paid vacation and holidays

Health insurance

401K

Pet insurance

Descrizione del lavoro

Resource Management Concepts, Inc. (RMC) seeks a Detection Engineer Analyst for an active government contract in Quantico, VA, delivering defensive Cyberspace Operations and CSSP functions.

The role develops detection use cases from current threats and MITRE ATT&CK, reviews incidents, tunes SIEM/SOAR, and creates high-fidelity rules while maintaining a low false-positive rate. A TS/SCI eligibility (or SECRET with eligibility) is required, along with relevant certifications.

Competenze

• ,

Mansioni

• Develop detection use cases based on current threats, the MITRE ATT&CK framework, and government direction.
• Review incident reporting to tune related detection use cases as necessary.
• Review SIEM/SOAR incident queue for unnecessary events and alerts and implement corrective actions.
• Identify gaps in logging and detection capabilities across attack surface.
• Assist in implementing new log ingestion and verify proper parsing and normalization of data in SIEM/SOAR.
• Create high fidelity correlation rules, signatures, filters, and automations and maintain low false-positive rate.

Conoscenze

Active TS/SCI eligibility

DoD 8570 IAT Level III certification

DoD 8570 CSSP Analyst certification

Incident detection experience

Signature writing (KQL/Snort/ePO/Yara)

Formazione

College degree in a technical or managerial discipline

HS Diploma or equivalency certificate

Strumenti

SIEM/SOAR platforms

KQL

Snort

ePO

Yara

Descrizione del lavoro

Resource Management Concepts, Inc. (RMC) seeks a Detection Engineer Analyst for an active government contract in Quantico, VA, delivering defensive Cyberspace Operations and CSSP functions.

The role develops detection use cases from current threats and MITRE ATT&CK, reviews incidents, tunes SIEM/SOAR, and creates high-fidelity rules while maintaining a low false-positive rate. A TS/SCI eligibility (or SECRET with eligibility) is required, along with relevant certifications.