Detection Engineer: Elastic & Cloud Threat Detection

BreakPoint Labs, LLC; South Carolina; On-site; USD 120,000 - 180,000; Full time

Job summary

BreakPoint Labs, LLC is seeking two Detection Engineers—one with Elastic expertise and another with Cloud-focused detection skills—to design, develop, and implement threat detection in a CSSP environment. You will craft high-fidelity rules in Elastic, align detections to MITRE ATT&CK, and work with DCO Watch Analysts to integrate detections into incident workflows.

You will validate rules, minimize false positives, and ensure compliance with CJCSM reporting and DoD directives.

Qualifications

• 5+ years of experience in a CSSP, SOC, or similar environment.
• 2+ years of experience with signature development, detection logic creation and optimization.
• Hands-on experience with Elastic Stack, Kibana, KQL, EQL, ES|QL and Elastic Defend.
• Familiarity with threat intelligence platforms and indicator management.
• Strong understanding of IDS/IPS detection engineering and MITRE ATT&CK mappings.
• DoD 8570 IAT Level II and DoD 8140 CSSP certifications; DoD Secret clearance.
• Bachelor’s degree or 8+ years in CSSP/SOC equivalent; willingness to meet education requirement.

Responsibilities

• Develop, implement, and maintain high-fidelity detection rules targeting adversary TTPs mapped to MITRE ATT&CK.
• Create risk-based alerting aligned with organizational risk assessments.
• Analyze threat intel to tailor detections for customer environments.
• Validate and test rules to minimize false positives and maximize detection accuracy.
• Collaborate with DCO Watch Analysts to integrate detections into monitoring/workflows.
• Maintain detection tools and SOP documentation; stay compliant with directives.
• Coordinate with reporting agencies and sites to align strategies with threat intel.
• Participate in program reviews, product evaluations, and onsite certification evaluations.

Education

Bachelor's Degree in a relevant discipline

Tools

Elastic Stack

Kibana KQL

EQL

ES|QL

Elastic Defend

Job description

BreakPoint Labs, LLC is seeking two Detection Engineers—one with Elastic expertise and another with Cloud-focused detection skills—to design, develop, and implement threat detection in a CSSP environment. You will craft high-fidelity rules in Elastic, align detections to MITRE ATT&CK, and work with DCO Watch Analysts to integrate detections into incident workflows.

You will validate rules, minimize false positives, and ensure compliance with CJCSM reporting and DoD directives.