Detection Engineering SME

Softthink Solutions; Washington (District of Columbia); On-site; USD 150,000 - 210,000; Full time

Job summary

Softthink Solutions in Washington, DC seeks a Detection Engineering SME to lead the creation of detection content for our security operations. You will author up to 3,500 single-event rules and 200 multi-event correlations, ensuring our threat detections remain modern and effective against current adversary techniques.

You will deploy detections, validate performance, and tune thresholds while integrating threat intelligence sources. Prior experience with cloud-native SIEMs is required.

Qualifications

• 7+ years of experience in detection engineering, threat hunting, or cyber analytics.
• Experience authoring SIEM rules and correlation logic.
• Experience with MITRE ATT&CK, threat intelligence, and adversary emulation.
• Experience with cloud-native SIEM platforms.

Responsibilities

• Author detection rules for Google SecOps SIEM.
• Deploy curated detections and validate rule performance.
• Build multi-event correlation rules aligned to MITRE ATT&CK.
• Tune detections to meet false-positive thresholds.
• Integrate threat intelligence sources into detection logic.
• Support UEBA risk scoring and insider-threat detection.
• Provide expert guidance during Detect & Tune and Operationalize phases.

Skills

Detection engineering

SIEM rule authoring

MITRE ATTCK framework

Cloud-native SIEM platforms

Education

Bachelor's degree in Cybersecurity/CS

Job description

Detection Engineering SME

Location: Washington, DC

Work Authorization: US Citizen

Role Summary

The Detection Engineering SME leads the development of detection content, including up to 3,500 single-event rules and 200 multi-event correlation rules. This role ensures SBA’s threat detection posture is modern, comprehensive, and aligned with current adversary techniques.

Roles & Responsibilities

• Author detection rules for Google SecOps SIEM.
• Deploy curated detections and validate rule performance.
• Build multi-event correlation rules aligned to MITRE ATT&CK.
• Tune detections to meet false-positive thresholds.
• Integrate threat intelligence sources into detection logic.
• Support UEBA risk scoring and insider-threat detection.
• Provide expert guidance during Detect & Tune and Operationalize phases.

Professional Experience Required

• 7+ years of experience in detection engineering, threat hunting, or cyber analytics.
• Experience authoring SIEM rules and correlation logic.
• Experience with MITRE ATT&CK, threat intelligence, and adversary emulation.
• Experience with cloud-native SIEM platforms.

Educational Qualification

• Bachelor’s degree in Cybersecurity, Computer Science, or related field.

Certifications

• GIAC Detection Engineering (GCTI, GDAT), CISSP, or equivalent preferred.