Senior Detection Engineer

SAIC; Tennessee; Hybrid; USD 60,000 - 100,000; Full time

Job summary

SAIC in Oak Ridge, Tennessee, seeks a Senior Detection Engineer to join the ESOC Detection Engineering Team. You will build high‑fidelity detections across SIEM, EDR, and telemetry to sustain enterprise visibility and rapid response.

The Senior Analyst will mentor analysts, tune detections, translate CTI into practical rules, and partner with CTI, OSO, and Purple Team to validate coverage, while supporting 24/7 operations as required.

Qualifications

• Bachelor’s degree with 5+ years related experience or Master’s with 3+ years
• Minimum 3 years of cybersecurity operations experience with enterprise SIEM Splunk
• Must have CySA+, SSCP, or equivalent
• Must obtain Splunk Certified Cybersecurity Defense Engineer within six months of hire

Responsibilities

• Operationally develop, deploy, and maintain high‑fidelity detections across SIEM, EDR, and other security telemetry platforms to support continuous monitoring and response.
• Validate alerts with Detection & Response team and refine workflows to align with operational needs.
• Provide rapid detection-focused support during active incidents, including tuning recommendations and data enrichment.
• Continuously tune and optimize detections to improve fidelity and reduce false positives.
• Perform advanced threat and telemetry analysis to confirm detection performance and coverage of emerging threats.
• Translate observed CTI into reliable, actionable detections aligned with DCO requirements.
• Collaborate with CTI, OSO, and Purple‑Team operators to validate logic and refine monitoring gaps.
• Convert threat-hunting findings into improved detection logic and monitoring enhancements.
• Maintain documentation for detection logic, tuning actions, and workflows to support repeatability.
• Mentor Detection Engineering analysts and support capability development within ESOC/DCO

Skills

Splunk SPL

Python

Leadership

Self-motivated

Excellent communication

Multitasking

Education

Bachelor's degree + 5+ years experience / Master’s + 3+ years

CySA+, SSCP, or equivalent

Splunk Certified Cybersecurity Defense Engineer within 6 months

Job description

Description

SAIC has an opening for a Senior Detection Engineer. This position is located in Oak Ridge, Tennessee; however, SAIC is open to remote work for qualified candidates.

This role serves as a Senior Technical Analyst within SAIC’s Enterprise Security Operations Center (ESOC) and Detection Engineering Team. Reporting to the Manager of Defensive Cyber Operations (DCO), the Senior Analyst is responsible for enhancing enterprise-wide threat detection capabilities. The Senior Analyst develops high‑fidelity detections on an operational cadence across SIEM, EDR, and other security telemetry platforms, ensuring SAIC maintains strong visibility into adversary tactics and emerging threats. In this position, the analyst works closely with the 24/7 Detection and Response, Cyber Incident Response, Cyber Threat Intelligence, Offensive Security Operations, and Sustainment teams to operationalize detections and continuously strengthen the organization’s defensive posture.

In addition to advanced threat analysis and detection engineering responsibilities, the Senior Analyst mentors Detection Engineering analysts and collaborates across teams to support capability development, detection tuning, and documentation improvements. This includes contributing to continuous improvement initiatives and participating in cross-team knowledge-sharing activities that align with broader ESOC and DCO operational objectives.

The position will work a 4×10 schedule, 07:00 a.m. EST – 5:00 p.m. EST, Monday–Thursday, with the expectation to support 24/7/365 operations when required.

Job Duties:

• Operationally develop, deploy, and maintain high‑fidelity detections across SIEM, EDR, and other security telemetry platforms to support continuous monitoring and response.
• Work closely with the Detection & Response team to validate alerts, refine workflows, and ensure engineered detections align with operational needs and real‑world analyst workflows.
• Provide rapid detection‑focused support during active incidents, including tuning recommendations, data enrichment, and technical guidance for investigation teams.
• Conduct ongoing tuning and optimization to improve detection fidelity, reduce false positives, strengthen efficiency, and close visibility gaps across the enterprise.
• Perform advanced threat and telemetry analysis to confirm detection performance, identify adversary behaviors, and ensure coverage of emerging threats.
• Operationalize Cyber Threat Intelligence (CTI) by translating observed TTPs, indicators, and behavioral patterns into reliable, actionable detections aligned with DCO mission requirements.
• Partner with CTI, Offensive Security Operations (OSO), and Purple‑Team operators to validate detection logic through adversary emulation, exercise detection coverage, and refine monitoring gaps identified during testing.
• Convert threat‑hunting discoveries, vulnerability insights, and purple‑team findings into improved detection logic, analytics, and monitoring enhancements.
• Maintain clear documentation for detection logic, tuning actions, workflows, and operational standards to support consistency and repeatability across the SOC.
• Mentor Detection Engineering analysts and support development of Detection & Response personnel to strengthen operational capability and readiness.
• Contribute to ESOC/DCO improvement initiatives, including engineering sprints, automation efforts, detection content onboarding, and process refinement.
• Lead post‑incident detection reviews to identify root‑cause gaps, update detection coverage, and improve overall defensive posture.
• Enhance dashboards, analytics, and tooling used across ESOC to support monitoring, triage, and investigative operations.
• Support the ESOCs 24/7/365 operational needs as required to maintain continuity of coverage during high‑priority or elevated‑tempo events.
• Perform additional duties and support other operational tasks as assigned to meet mission and organizational needs.

Qualifications

Education and Experience Requirements:

• Bachelor’s degree and 5+ years related experience, or a Master’s degree and 3+ years of related experience. An additional 4+ years of experience may be considered in lieu of a degree.
• Must have a minimum of 3 years of cybersecurity operations experience working with the enterprise SIEM Splunk.
• Must possess one of the following certifications: CySA+, SSCP, or equivalent
• Must obtain the following certification within six (6) months of hire: Splunk Certified Cybersecurity Defense Engineer.

Required Skills:

• Advanced proficiency in Splunk SPL and Python for security automation and workflow development.
• Strong leadership skills with a proven ability to lead and motivate a team effectively.
• Can-do attitude.
• Self-motivated and quick learner.
• Excellent verbal and written communication skills.
• Ability to multitask and collaborate to solve complex technical problems.

Desirables:

• One or more of the following certifications: ISC2 - CISSP, Splunk Certified Cybersecurity Defense Analyst, Splunk Certified Cybersecurity Defense Engineer.

Target salary range: $60,001 - $100,000. The estimate displayed represents the typical salary range for this position based on experience and other factors.