Remote Detection Engineer: SIEM & Threat Hunting

OpenTalent; Rockville (MD); On-site; USD 70,000 - 90,000; Full time

Job summary

Blu Omega is seeking a Detection Engineer for a fully remote position supporting a federal program focused on protecting critical health systems and data. You will develop detections, write SPL queries, and maintain dashboards within Splunk while collaborating with SOC and incident response teams.

The role requires 2+ years in security monitoring, experience with Splunk, and familiarity with phishing analysis and threat hunting. NIH Public Trust clearance is a plus.

Qualifications

• 2+ years of cybersecurity experience including security monitoring, SOC operations, SIEM, threat hunting, incident response, or detection engineering.
• Experience with Splunk or a comparable SIEM platform and SPL queries.
• Understanding of common cybersecurity threats and attacker techniques.

Responsibilities

• Develop and maintain security alerts and detection rules within Splunk
• Write and modify SPL queries to identify suspicious or potentially malicious activity
• Create and maintain Splunk dashboards, reports, and security analytics
• Review and tune existing detections to improve accuracy and reduce false positives
• Support phishing detection and analysis using Cofense Triage or similar tools
• Assist with the development and maintenance of YARA rules
• Use SnapAttack and other security tools to support detection development and analysis
• Leverage built-in security analytics and detections across cybersecurity tools
• Support threat hunting and investigation of suspicious activity
• Apply MITRE ATT&CK concepts to understand attacker behaviors and detection coverage
• Work with SOC analysts, incident responders, and other cybersecurity team members to improve monitoring and detection capabilities
• Document detection rules, queries, dashboards, and investigative procedures

Skills

SOC operations

Threat hunting

Incident response

Analytical skills

Communication

Tools

Splunk

SPL

Cofense Triage

YARA

SnapAttack

MITRE ATT&CK

Job description

Blu Omega is seeking a Detection Engineer for a fully remote position supporting a federal program focused on protecting critical health systems and data. You will develop detections, write SPL queries, and maintain dashboards within Splunk while collaborating with SOC and incident response teams.

The role requires 2+ years in security monitoring, experience with Splunk, and familiarity with phishing analysis and threat hunting. NIH Public Trust clearance is a plus.