Hands-on SIEM & Detection Engineer: Build Threat Signals

Minerva Cyber Tech; Columbia (MD); On-site; USD 120,000 - 150,000; Full time

Job summary

Minerva Cyber Technologies is seeking a SIEM and Detection Engineer to boost security monitoring quality. You will onboard log sources, develop detections, and help SOC analysts investigate signals with actionable context.

You will assess coverage, build and test rules across multiple data domains, tune detections to reduce noise, and create dashboards and escalation workflows with SOC teams. This role emphasizes detection content, testing, and documentation.

Qualifications

• Hands-on experience administering a SIEM or developing production detection content.
• Ability to query security data and explain the behavior and limitations behind a detection.
• Understanding of MITRE ATT&CK framework, log sources, and investigation workflows.
• Practical scripting, version control, testing, and technical documentation skills.
• Ability to travel to client sites as needed.

Responsibilities

• Assess log coverage, collection health, parsing, normalization, and retention requirements.
• Build and test detection rules across endpoint, identity, network, application, and cloud data.
• Tune rules to reduce false positives and noise while measuring coverage.
• Create investigation guidance, dashboards, and escalation workflows with SOC teams.
• Version detection content (detection as code), document tests, and maintain change/deployment records.

Skills

SIEM engineering

Detection engineering

Threat detection

Scripting

Version control

Testing

Technical documentation

Client-site travel

Tools

Splunk

Elastic

Microsoft Sentinel

Sigma

SOAR workflows

Job description

Minerva Cyber Technologies is seeking a SIEM and Detection Engineer to boost security monitoring quality. You will onboard log sources, develop detections, and help SOC analysts investigate signals with actionable context.

You will assess coverage, build and test rules across multiple data domains, tune detections to reduce noise, and create dashboards and escalation workflows with SOC teams. This role emphasizes detection content, testing, and documentation.