DoD TS Clearance SIEM Detection Engineer

MartinFed; Washington (District of Columbia); On-site; USD 110,000 - 160,000; Full time

Job summary

MartinFed is seeking an SIEM Detection Engineer to develop, tune, and maintain Splunk-based detections for government-focused security operations. You will own correlation searches, alerts, and use cases aligned to MITRE ATT&CK, leveraging threat intelligence to minimize noise while maximizing coverage.

The role collaborates with security analysts, threat intel teams, and platform engineers to ensure precise detection, validated content, and actionable dashboards for SOC triage and investigation

Qualifications

• Detection development in SPL: correlation searches, scheduled searches, alerts, and thresholds.
• Security use case design mapped to MITRE ATT&CK.
• Alert tuning and false-positive reduction while maintaining coverage.
• Threat intelligence application and IOC/behavioral detection logic.
• Dashboard and visualization development for SOC triage and investigation.
• Detection testing and validation against known attack techniques and sample data.
• Working knowledge of Splunk Enterprise Security (ES): notable events, risk-based alerting (RBA), and data models.
• Understanding of the incident response lifecycle and SOC workflows.
• Familiarity with adversary tactics, techniques, and common attack patterns across endpoint, network, and cloud.

Responsibilities

• Detection Development: Develop and optimize search queries, correlation searches, and SPL alerts.
• Use Case Development: Design security use cases mapped to MITRE ATT&CK and drive by threat intel.
• Alert Tuning: Reduce false positives while preserving coverage and relevance.
• Dashboards & Visualization: Build dashboards for SOC triage and investigation.
• Threat Detection Support: Monitor events and provide detection context for incident response.
• Detection Testing & Validation: Test detections with known techniques and document outcomes.
• Collaboration & Documentation: Coordinate with analysts and threat intel; maintain runbooks and docs.

Skills

Detection SPL development

MITRE ATT&CK mapping

Alert tuning

Threat intelligence

SOC dashboards

Detections testing

Splunk ES basics

IR lifecycle knowledge

Threat patterns across tech

Job description

MartinFed is seeking an SIEM Detection Engineer to develop, tune, and maintain Splunk-based detections for government-focused security operations. You will own correlation searches, alerts, and use cases aligned to MITRE ATT&CK, leveraging threat intelligence to minimize noise while maximizing coverage.

The role collaborates with security analysts, threat intel teams, and platform engineers to ensure precise detection, validated content, and actionable dashboards for SOC triage and investigation