Senior Detection Engineer – Threat Hunting Lead (TS/SCI)

ARSIEM Corporation; Arlington (VA); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Referral bonus $3,500

Job summary

ARSIEM Corporation is seeking a Senior Detection Engineer to develop, test, and tune detection logic across endpoint, network, identity, cloud telemetry, and SIEM/XDR platforms. You will translate threat intel and incident lessons into validated detections and automation, enabling faster, repeatable hunts for federal and critical infrastructure environments.

You’ll work with threat hunters, engineers, data scientists, and analytics developers to improve coverage, fidelity, and operational value

Qualifications

• Bachelor’s degree in Engineering, Computer Science, Cybersecurity, Information Systems, or related field (Master’s Degree preferred)
• 10+ years of directly relevant experience
• Senior-level threat hunting, detection engineering, incident response, or related defensive cyber ops with ownership of production detection content
• Strong hypothesis development and adversary behavior analysis skills
• Proficiency in security query languages (KQL, SPL, EQL, ES|QL) and cross-platform logic
• Experience mapping detections to MITRE ATT&CK and validating telemetry and coverage

Responsibilities

• Develop and test hypotheses to uncover persistence, privilege escalation, credential access, lateral movement, and C2 techniques
• Build behavioral analytics, correlations, signatures, and queries across endpoint, network, identity, cloud telemetry
• Translate hunt findings into reusable detections and automation
• Document detection purpose, data requirements, assumptions, and limitations
• Coordinate remediation with infrastructure and validate restored coverage
• Develop automation for enrichment, query execution, and detection validation (SOAR playbooks)

Skills

Threat hunting

Detection engineering

MITRE ATT&CK mapping

Python

PowerShell

KQL/SPL/EQL

Incident response

Data analytics

Education

Bachelor’s degree (Engineering/CS/Cybersecurity)

Master’s degree preferred

Tools

CrowdStrike Falcon

Microsoft Defender

Cortex XDR

Splunk

Elastic

Job description

ARSIEM Corporation is seeking a Senior Detection Engineer to develop, test, and tune detection logic across endpoint, network, identity, cloud telemetry, and SIEM/XDR platforms. You will translate threat intel and incident lessons into validated detections and automation, enabling faster, repeatable hunts for federal and critical infrastructure environments.

You’ll work with threat hunters, engineers, data scientists, and analytics developers to improve coverage, fidelity, and operational value