Detection Engineer Lead

K&A Technologies LLC; Washington; Hybrid; USD 165,000 - 190,000; Full time

Job summary

K&A Technologies LLC is seeking an experienced Detection Engineering Lead to drive enterprise cybersecurity detections using Splunk ES and advanced analytics. You will lead hypothesis-driven threat hunts, develop SPL queries, and map findings to MITRE ATT&CK, while guiding SOPs and operational deliverables.

The role emphasizes leadership across detection engineering, threat hunting, and documentation, with a focus on reducing alert noise and improving detection fidelity in a large enterprise

Qualifications

• Minimum 5 years of Incident Response experience within a large SOC environment supporting more than 5,000 endpoints.
• At least 3 years of experience focused on proactive detection engineering, threat hunting, or adversary emulation.
• At least 3 years developing investigative hypotheses, querying large datasets, and identifying sophisticated or APT-related behavior.
• At least 2 years hands-on experience developing detections within a SIEM, with strong preference for Splunk Enterprise Security.
• Strong proficiency developing and optimizing Splunk SPL searches and security detections.
• At least 2 years of demonstrated experience using Python and PowerShell to develop security tools, scripts, or automation.
• Demonstrated ability to develop SOPs, work instructions, playbooks, and technical documentation.
• Strong understanding of threat hunting methodologies, attacker TTPs, incident response, security telemetry, and MITRE ATT&CK.
• Excellent verbal and written communication skills.

Responsibilities

• Lead the development, testing, tuning, deployment, and lifecycle management of security detections within Splunk Enterprise Security (ES).
• Develop advanced SPL queries, correlation searches, and security analytics using enterprise-scale telemetry.
• Conduct hypothesis-driven threat hunts across endpoints, network, authentication, identity, cloud, and other data sources.
• Identify suspicious activity related to APTs and emerging attacker behaviors.
• Translate threat intel, incident findings, and attacker techniques into detection logic.
• Map detections to MITRE ATT&CK and identify gaps in coverage.
• Tune detections to improve fidelity and reduce false positives, providing actionable context.
• Develop scripts and automation using Python and PowerShell.
• Create and maintain SOPs, playbooks, and technical procedures for detection engineering.
• Ensure documentation reflects operational processes and evolving program requirements.
• Support completion of contractual or program deliverables for detection engineering.
• Collaborate with SOC analysts, incident responders, threat intel, and security engineers to strengthen detection capabilities.
• Provide technical leadership and mentorship in detection engineering and threat hunting.

Skills

Splunk ES

SPL queries

Threat hunting

MITRE ATT&CK

Python

PowerShell

Documentation

Incident response

Communication

Tools

KQL

Job description

Washington, DC Metro Area | Primarily Remote

Occasional onsite support may be required

K&A Technologies LLC is seeking an experienced Detection Engineering Lead to support a large-scale enterprise cybersecurity program. This role will provide technical leadership across detection engineering, proactive threat hunting, advanced security analytics, and the development of operational documentation and contract deliverables supporting the detection function.

The ideal candidate will have strong hands‑on experience with Splunk Enterprise Security, advanced SPL development, detection lifecycle management, threat hunting, and identifying sophisticated adversary behavior across large datasets.

Success in this role means building high‑fidelity detections, continuously improving detection coverage, reducing unnecessary alert noise, identifying emerging attacker behavior, and ensuring the detection engineering function is supported by clear, repeatable processes, documentation, and required deliverables.

Responsibilities

• Lead the development, testing, tuning, deployment, and lifecycle management of security detections within Splunk Enterprise Security (ES).
• Develop advanced SPL queries, correlation searches, and security analytics using enterprise-scale security telemetry.
• Conduct hypothesis‑driven threat hunts across endpoint, network, authentication, identity, cloud, and other security data sources.
• Identify suspicious activity associated with advanced persistent threats, attacker behaviors, and emerging TTPs.
• Translate threat intelligence, incident findings, and adversary techniques into new or improved detection logic.
• Map detections and threat‑hunting activities to the MITRE ATT&CK framework and identify gaps in detection coverage.
• Tune existing detections to improve fidelity, reduce false positives, and provide analysts with actionable investigative context.
• Develop scripts, automation, enrichment tools, and supporting utilities using Python and PowerShell.
• Develop, maintain, and update Standard Operating Procedures (SOPs), work instructions, playbooks, technical procedures, process documentation, and other required detection engineering deliverables.
• Ensure detection engineering documentation accurately reflects operational processes, technical procedures, roles, responsibilities, and evolving program requirements.
• Support the preparation, review, and timely completion of recurring and ad hoc contractual or program deliverables assigned to the detection engineering team.
• Collaborate with SOC analysts, incident responders, threat intelligence personnel, and security engineers to strengthen enterprise detection capabilities.
• Provide technical leadership, mentorship, and guidance related to detection engineering and threat hunting.

Qualifications

• Minimum 5 years of Incident Response experience within a large SOC environment supporting more than 5,000 endpoints.
• At least 3 years of experience focused on proactive detection engineering, threat hunting, or adversary emulation.
• At least 3 years of demonstrated experience developing investigative hypotheses, querying large datasets, and identifying sophisticated or APT‑related behavior.
• At least 2 years of hands‑on experience developing detections within a SIEM, with strong preference for Splunk Enterprise Security.
• Strong proficiency developing and optimizing Splunk SPL searches and security detections.
• At least 2 years of demonstrated experience using Python and PowerShell to develop security tools, scripts, or automation.
• Demonstrated ability to develop clear SOPs, work instructions, playbooks, technical documentation, and operational deliverables.
• Strong understanding of threat hunting methodologies, attacker TTPs, incident response, security telemetry, and MITRE ATT&CK.
• Ability to independently analyze complex security activity and convert investigative findings into repeatable detection content and documented operational processes.
• Strong verbal and written communication skills.

Required Certification

Candidates must currently hold at least one of the following certifications:

• OSCP – Offensive Security Certified Professional
• GXPN – GIAC Exploit Researcher and Advanced Penetration Tester

Security Requirement

Candidates must be able to obtain and maintain a U.S. Federal Public Trust for the duration of the engagement.

Preferred Experience

• Splunk Enterprise Security administration or engineering.
• Splunk Risk‑Based Alerting (RBA), correlation searches, CIM, or data models.
• Microsoft Sentinel and KQL.
• Detection‑as‑code, Sigma, Git, or CI/CD workflows.
• Adversary emulation or purple‑team activities.
• Experience supporting large enterprise or federal cybersecurity environments.
• Experience developing documentation and formal deliverables in a government contracting or similarly structured environment.

Anticipated W‑2 Salary Range: $165,000–$190,000 annually, based on experience, technical depth, certification, and overall qualifications.

This position is contingent upon contract award.