Security Engineer III - SIEM Automation & Content

Relha LLC; Herndon (VA); Hybrid; USD 113,000 - 188,000; Full time

Job summary

Deloitte’s GPS practice seeks a Security Engineer III to join the Government & Public Services team in Herndon, VA. The role focuses on automating security workflows, developing SIEM content, and managing correlation rules across government clients.

The position requires an active Secret Clearance and onsite presence up to 3 days weekly. The candidate should demonstrate strong collaboration, risk-aware decision making, and the ability to lead technical workstreams.

Qualifications

• Bachelor's Degree or relevant experience in lieu of degree required.
• Active Secret Clearance required.
• Ability to work onsite in Herndon, VA up to 3 days a week.

Responsibilities

• Implement automation to optimize security workflows.
• Develop content for security platforms such as Splunk, Archer, Tanium, Trellix, FireEye, and CrowdStrike.
• Build, implement, and manage SIEM correlation rules, logic, and content.
• Tune SIEM rules to reduce false positives, known errors, and unexpected network behavior.
• Create scheduled and ad hoc reporting, maintain event schemas, and apply customized security severity criteria.
• Travel 15% on average based on client needs and engagements.

Skills

Independent work

Communication skills

Detail oriented

Relationship building

Project leadership

Time management

Deadline driven

Mentoring

Education

Bachelor's degree or equivalent experience

Tools

Splunk

Archer

Tanium

Trellix

FireEye

CrowdStrike

Job description

Deloitte’s GPS practice seeks a Security Engineer III to join the Government & Public Services team in Herndon, VA. The role focuses on automating security workflows, developing SIEM content, and managing correlation rules across government clients.

The position requires an active Secret Clearance and onsite presence up to 3 days weekly. The candidate should demonstrate strong collaboration, risk-aware decision making, and the ability to lead technical workstreams.