Elastic Cloud Threat Detection Engineer

BreakPoint Labs, LLC; Charleston (SC); On-site; USD 120,000 - 150,000; Full time

Job summary

BreakPoint Labs, LLC seeks two Detection Engineers (Elastic and Cloud) to design, develop, and implement detection mechanisms for a CSSP environment. You will craft high-fidelity rules in Elastic, map adversary TTPs to MITRE ATT&CK, and work with DCO Watch Analysts to ensure timely threat detection.

The roles require DoD 8570 IAT Level II and DoD CSSP-specific certification, DoD Secret Clearance, and a Bachelor’s degree or equivalent experience. Expect up to 10% travel.

Qualifications

• 5+ years in CSSP, SOC, or similar environment.
• 2+ years in signature development or detection logic creation and optimization across platforms.
• Experience with Elastic Stack, Kibana, KQL, EQL, ES|QL or Elastic Defend.
• Experience with threat intel platforms and indicator management.
• Strong understanding of IDS/IPS and signature tuning.
• Clear communication and collaboration with DCO Watch Analysts and teams.

Responsibilities

• Develop, implement, and maintain high-fidelity detection rules in Elastic Security for MITRE ATT&CK mapped TTPs.
• Prioritize risk-based alerting aligned with risk assessments.
• Analyze threat intelligence to tailor detections to customer environments.
• Test detection rules to minimize false positives and improve threat identification.
• Collaborate with DCO Watch to integrate detections into monitoring and incident response workflows.
• Update detections in response to evolving threats and directives.
• Document SOPs for detection creation and implementation processes.
• Coordinate with reporting agencies and subscribers to align detection strategies.
• Participate in program reviews and on-site evaluations; travel up to 10%.

Skills

Elastic

Cloud

IDS/IPS

Signature development

Threat detection

Elastic Stack

Kibana

KQL

EQL

ES|QL

Elastic Defend

Threat intelligence

Indicator management

Education

Bachelor’s Degree in a relevant discipline

DoD 8570 IAT Level II

DoD CSSP-specific certification

8+ years CSSP/SOC experience

Tools

Elastic Stack

Kibana

Elasticsearch

Job description

BreakPoint Labs, LLC seeks two Detection Engineers (Elastic and Cloud) to design, develop, and implement detection mechanisms for a CSSP environment. You will craft high-fidelity rules in Elastic, map adversary TTPs to MITRE ATT&CK, and work with DCO Watch Analysts to ensure timely threat detection.

The roles require DoD 8570 IAT Level II and DoD CSSP-specific certification, DoD Secret Clearance, and a Bachelor’s degree or equivalent experience. Expect up to 10% travel.