Senior Elastic Threat Detection Engineer

BreakPoint Labs, LLC; South Carolina; On-site; USD 110,000 - 160,000; Full time

Job summary

BreakPoint Labs is seeking a Detection Engineer with Elastic expertise to design, develop, and implement threat detection mechanisms in a CSSP environment. Responsibilities include creating IDS/IPS signatures, log correlation rules, and detection tooling aligned to MITRE ATT&CK and CJCSM guidance.

The role requires DoD 8570 IAT Level II and CSSP certifications, a DoD Secret Clearance, and a Bachelor’s degree or 8+ years CSSP experience. Up to 10% travel may be required.

Qualifications

• 5+ years in CSSP/SOC environments.
• 2+ years of signature development and detection logic on multiple platforms.
• Experience with Elastic Stack and query languages.
• DoD 8570 IAT Level II and DoD 8140 CSSP certifications.
• DoD Secret Clearance.

Responsibilities

• Develop and maintain high-fidelity detection rules in Elastic.
• Create risk-based alerting aligned with risk assessments.
• Analyze threat intel to tailor detections for customers.
• Validate rules to minimize false positives.
• Collaborate with DCO Watch Analysts on workflows.
• Maintain SOPs and update tools against evolving threats.
• Travel up to 10% and participate in evaluations.

Skills

CSSP/SOC experience

Threat detection engineering

Analytical problem-solving

Communication skills

Independent troubleshooting

Education

Bachelor's degree or 8+ years CSSP experience

Tools

Elastic Stack

KQL

EQL

ES|QL

Elastic Defend

Threat intel platforms

Job description

BreakPoint Labs is seeking a Detection Engineer with Elastic expertise to design, develop, and implement threat detection mechanisms in a CSSP environment. Responsibilities include creating IDS/IPS signatures, log correlation rules, and detection tooling aligned to MITRE ATT&CK and CJCSM guidance.

The role requires DoD 8570 IAT Level II and CSSP certifications, a DoD Secret Clearance, and a Bachelor’s degree or 8+ years CSSP experience. Up to 10% travel may be required.