Senior Detection Engineer - Remote Threat Detection Lead

SAIC; United States; Remote; USD 120,000 - 160,000; Full time

Job summary

SAIC in Oak Ridge, TN is seeking a Senior Detection Engineer to join the Enterprise Security Operations Center (ESOC). The role offers remote work for qualified candidates and follows a 4x10 schedule, 07:00 a.m. EST - 5:00 p.m.

EST, Monday-Thursday, with on‑call support for 24/7/365 operations. The Senior Analyst will develop high‑fidelity detections across SIEM, EDR, and other telemetry, mentor Detection Engineering analysts, and collaborate with CTI, OSO, and Purple‑Team operators to

Qualifications

• Bachelor's degree in related field plus 5+ years cybersecurity operations experience; or Master's with 3+ years experience; additional 4+ years may substitute for degree.
• Minimum 3 years of cybersecurity operations experience with enterprise SIEM Splunk.
• Certifications: CySA+, SSCP, or equivalent; Splunk Certified Cybersecurity Defense Engineer within 6 months of hire.

Responsibilities

• Operationally develop, deploy, and maintain high-fidelity detections across SIEM, EDR, and other security telemetry platforms.
• Lead and mentor Detection Engineering analysts; support capability development and detection tuning.
• Collaborate with CTI, Offensive Security Operations, and Purple-Team operators to validate detection logic.

Skills

Leadership

Verbal communication

Written communication

Multitasking

Self-motivated

Quick learner

Can-do attitude

Education

Bachelor's degree in related field

Master's degree in related field

Tools

Splunk

Python

Job description

SAIC in Oak Ridge, TN is seeking a Senior Detection Engineer to join the Enterprise Security Operations Center (ESOC). The role offers remote work for qualified candidates and follows a 4x10 schedule, 07:00 a.m. EST - 5:00 p.m.

EST, Monday-Thursday, with on‑call support for 24/7/365 operations. The Senior Analyst will develop high‑fidelity detections across SIEM, EDR, and other telemetry, mentor Detection Engineering analysts, and collaborate with CTI, OSO, and Purple‑Team operators to