Detection Engineer (Elastic)

BreakPoint Labs, LLC; South Carolina; On-site; USD 110,000 - 160,000; Full time

Job summary

BreakPoint Labs is seeking a Detection Engineer with Elastic expertise to design, develop, and implement threat detection mechanisms in a CSSP environment. Responsibilities include creating IDS/IPS signatures, log correlation rules, and detection tooling aligned to MITRE ATT&CK and CJCSM guidance.

The role requires DoD 8570 IAT Level II and CSSP certifications, a DoD Secret Clearance, and a Bachelor’s degree or 8+ years CSSP experience. Up to 10% travel may be required.

Qualifications

• 5+ years in CSSP/SOC environments.
• 2+ years of signature development and detection logic on multiple platforms.
• Experience with Elastic Stack and query languages.
• DoD 8570 IAT Level II and DoD 8140 CSSP certifications.
• DoD Secret Clearance.

Responsibilities

• Develop and maintain high-fidelity detection rules in Elastic.
• Create risk-based alerting aligned with risk assessments.
• Analyze threat intel to tailor detections for customers.
• Validate rules to minimize false positives.
• Collaborate with DCO Watch Analysts on workflows.
• Maintain SOPs and update tools against evolving threats.
• Travel up to 10% and participate in evaluations.

Skills

CSSP/SOC experience

Threat detection engineering

Analytical problem-solving

Communication skills

Independent troubleshooting

Education

Bachelor's degree or 8+ years CSSP experience

Tools

Elastic Stack

KQL

EQL

ES|QL

Elastic Defend

Threat intel platforms

Job description

Job Description

BreakPoint Labs is seeking a Detection Engineer with an expertise in Elastic to design, develop, and implement detection mechanisms to identify cyber threats within a Cybersecurity Service Provider (CSSP) environment. The candidate will focus on creating and managing IDS/IPS signatures, log correlation rules, and other detection tools based on indicator lifecycle analysis. The Detection Engineer collaborates with Defensive Cyber Operations (DCO) Watch Analysts and other teams to ensure timely and effective threat detection, adhering to CJCSM 6510.01B reporting requirements and supporting the CSSP’s mission to protect data across a wide spectrum of sources and locations.

Responsibilities include:

• Develop, implement, and maintain custom, high-fidelity detection rules and logic in the Elastic Security platform specifically targeting adversary TTPs mapped to the MITRE ATT&CK® framework.
• Develop and prioritize risk-based alerting mechanisms to focus detection efforts on high-impact threats, aligning with organizational risk assessments.
• Analyze threat intelligence to create and refine detection mechanisms tailored to the customer’s environment.
• Validate and test detection rules to ensure accuracy, minimize false positive and benign positive matches, and enhance threat identification capabilities.
• Collaborate with DCO Watch Analysts to integrate detection mechanisms into monitoring and incident response workflows.
• Maintain and update detection tools and signatures in response to evolving threats, ensuring compliance with CJCSM 6510.01B and other applicable directives.
• Compile and maintain internal standard operating procedure (SOP) documentation for detection creation and implementation processes.
• Coordinate with reporting agencies and subscriber sites to align detection strategies with operational needs and threat intelligence.
• Participate in program reviews, product evaluations, and onsite certification evaluations to assess detection tool efficacy.
• Overtime may be required to support detection implementation or incident response actions (Surge).
• Up to 10% travel may be required.

Required Experience:

• 5+ years of experience working in a CSSP, SOC, or similar environment.
• 2+ years of experience with signature development, detection logic creation and optimization on multiple platforms.
• Experience in threat detection engineering, threat hunting, or a related role with hands‑on experience using the Elastic Stack, Kibana Query Language (KQL), Event Query Language (EQL), Elasticsearch Query Language (ES|QL) and/or Elastic Defend.
• Experience with threat intelligence platforms and indicator management.
• Proficient knowledge of detection creation and implementation processes.
• Expertise in IDS/IPS solutions, including signature development and optimization.
• Strong understanding of the indicator lifecycle, including initial discovery, development, operational maturity, and long-term sustainment.
• Effective verbal and written communication skills.
• Ability to solve complex problems independently.
• Preferred certifications: Elastic Certified Analyst; Elastic Certified SIEM Analyst, Elastic Certified Engineer.

Certifications Required: DoD 8570 IAT Level II and DoD 8140 CSSP-specific certification.

Security Clearance Required: DoD Secret Clearance.

Education Required: Bachelor’s Degree Area(s) of Studyof relevant discipline and 5 years of experience. OR, at least 8 years of experience working in a CSSP, SOC, or similar.

Company Description

BreakPoint Labs, a small business cybersecurity services firm, is dedicated to providing the methods and means for sustainable, measurable, and effective cybersecurity operations. Powered by highly motivated, experienced cybersecurity professionals with technical and scientific proficiency. We are known for developing and leveraging technology to enable a more secure cyberspace. With well-formed service delivery models in cybersecurity assessments, defensive cyber operations, research and development, and cybersecurity training, we are able to support a diverse customer base in addressing its most challenging problems in cyberspace.

We are constantly seeking enthusiastic cybersecurity professionals, either to exchange technical ideas and lessons learned or to potentially join our Team. Through an established corporate culture, we embrace a highly technical, [geeky] workforce passionate about developing and leveraging technology to secure cyberspace. We have recently merged with Valiant Solutions to make us stronger, an