Elastic Threat Detection Engineer - CSSP & DoD Security

BreakPoint Labs LLC; Charleston, Northern (SC, KY); Hybrid; USD 110,000 - 140,000; Full time

Job summary

BreakPoint Labs LLC is seeking a Detection Engineer specializing in Elastic to design and implement detection mechanisms for cyber threats within a CSSP environment. You will develop IDS/IPS signatures, log correlation rules, and detection tools guided by the MITRE ATT&CK framework and indicator lifecycle.

The role requires 5+ years in CSSP/SOC and hands-on Elastic Stack expertise. DoD 8570 IAT II and CSSP certifications are expected, with DoD Secret Clearance as a potential requirement.

Qualifications

• 5+ years in a CSSP, SOC or similar environment.
• 2+ years developing and optimizing detection signatures across platforms.
• Hands-on experience with Elastic Stack, KQL/EQL and Elastic Defend.
• Experience with threat intelligence platforms and indicator management.
• Expertise in IDS/IPS signature development and optimization.
• Strong understanding of the indicator lifecycle.
• Certifications: Elastic Certified Analyst/SIEM/Engineer; DoD 8570 IAT II; DoD 8140 CSSP-specific.

Responsibilities

• Develop, implement, and maintain high-fidelity detection rules in Elastic for MITRE ATT&CK mapped adversary TTPs.
• Prioritize risk-based alerting aligned with risk assessments.
• Analyze threat intelligence to tailor detections to customer environments.
• Test rules to minimize false positives and improve detection accuracy.
• Collaborate with DCO Watch Analysts to integrate detections into monitoring workflows.
• Maintain detection tooling and SOP documentation; ensure compliance with directives.
• Coordinate with reporting agencies and sites on detection strategies.
• Support program reviews and certification evaluations; possible surge work; up to 10% travel.

Skills

Threat detection

Threat hunting

Problem solving

Communication

Independent work

Education

Bachelor's degree in a relevant discipline

CSSP/SOC experience (8+ years)

Tools

Elastic Stack

Kibana/KQL

EQL

ES|QL

Elastic Defend

IDS/IPS concepts

Job description

BreakPoint Labs LLC is seeking a Detection Engineer specializing in Elastic to design and implement detection mechanisms for cyber threats within a CSSP environment. You will develop IDS/IPS signatures, log correlation rules, and detection tools guided by the MITRE ATT&CK framework and indicator lifecycle.

The role requires 5+ years in CSSP/SOC and hands-on Elastic Stack expertise. DoD 8570 IAT II and CSSP certifications are expected, with DoD Secret Clearance as a potential requirement.