Detection Engineering SME: SIEM Rules & Threat Detection Lead

Softthink Solutions Inc; Washington (District of Columbia); On-site; USD 150,000 - 190,000; Full time

Job summary

Softthink Solutions Inc in Washington, DC is seeking a Detection Engineering SME to lead the development of detection content, including up to 3,500 single-event rules and 200 multi-event correlation rules, ensuring a modern threat posture.

You will author rules for Google SecOps SIEM, deploy detections, and build MITRE ATT&CK aligned correlations, while tuning rules to minimize false positives and integrating threat intelligence.

Qualifications

• 7+ years of experience in detection engineering, threat hunting, or cyber analytics.
• Experience authoring SIEM rules and correlation logic.
• Experience with MITRE ATT&CK, threat intelligence and adversary emulation.
• Experience with cloud-native SIEM platforms.

Responsibilities

• Author detection rules for Google SecOps SIEM.
• Deploy curated detections and validate rule performance.
• Build multi-event correlation rules aligned to MITRE ATT&CK.
• Tune detections to meet false-positive thresholds.
• Integrate threat intelligence sources into detection logic.
• Support UEBA risk scoring and insider-threat detection.
• Provide expert guidance during Detect & Tune and Operationalize phases.

Skills

Detection engineering

Threat hunting

SIEM rules

MITRE ATT&CK

Cloud-native SIEM

Threat intelligence

UEBA risk scoring

Education

Bachelor’s degree in Cybersecurity or Computer Science

Tools

Google SecOps SIEM

Cloud-native SIEM platforms

Threat intelligence sources

Job description

Softthink Solutions Inc in Washington, DC is seeking a Detection Engineering SME to lead the development of detection content, including up to 3,500 single-event rules and 200 multi-event correlation rules, ensuring a modern threat posture.

You will author rules for Google SecOps SIEM, deploy detections, and build MITRE ATT&CK aligned correlations, while tuning rules to minimize false positives and integrating threat intelligence.