On-Site Cyber Threat Detection Engineer (SIEM/Signatures)

RISA; St. Louis (MO); On-site; USD 78,000 - 86,000; Full time

Benefits offered by this job

Medical, dental, and vision insurance

401(k) and Roth IRA

Paid Time Off

11 paid Federal Holidays

Job summary

RISA, located in St. Louis, MO, is seeking an experienced Cyber Threat Detection Engineer to develop and tune SIEM rules, signatures, and scripts.

You will participate in a Fusion model with Defensive Cyber Operations, focusing on hunt and detection engineering rather than queue-clearing. You will analyze trends, convert intelligence into deployed logic, and run Purple Team exercises while supporting the Cyber Incident Response Team during live activity.

Qualifications

• U.S. citizenship and an active TS/SCI clearance
• Ability to obtain and maintain a Government polygraph after hire
• Bachelor's degree in a field relevant to the position plus 6 years of experience (equivalents accepted)
• 8+ years of advanced cyber security analytics experience
• DoD 8140.01 / 8570.01-M IAT III and CSSP Analyst certification
• Data mining or query building in a SIEM
• Strong signature development, tuning and network protocol analysis
• Good knowledge of regular expressions

Responsibilities

• Analyze trends to identify and predict events, then develop or tune rules, signatures, and scripts
• Convert intelligence and incident reports into deployed detection logic
• Run regular Purple Team exercises and validate countermeasures
• Collaborate with Cyber Data Analytics on SIEM alert efficiency
• Support the Incident Response Team during live activity and assist triage
• Document work in the ticketing system for traceability

Skills

U.S. citizenship

Active TS/SCI clearance

DoD 8140/8570 IAT III / CSSP Analyst

SIEM data mining / query building

Signature development & tuning

Regex / protocol analysis

Education

Bachelor's degree + 6 years experience

Master's + 4 years

Tools

Python

Bash

PowerShell

Job description

RISA, located in St. Louis, MO, is seeking an experienced Cyber Threat Detection Engineer to develop and tune SIEM rules, signatures, and scripts.

You will participate in a Fusion model with Defensive Cyber Operations, focusing on hunt and detection engineering rather than queue-clearing. You will analyze trends, convert intelligence into deployed logic, and run Purple Team exercises while supporting the Cyber Incident Response Team during live activity.