Senior SIEM Content Engineer: Threat Detection & Scripting

BMA; Columbus (OH); On-site; USD 120,000 - 160,000; Full time

Benefits offered by this job

401(k) match

Employee Stock Ownership Plan (ESOP)

Healthcare options

Dental and vision coverage

Short- and long-term disability

Job summary

BMA is seeking a SIEM Content Developer in Columbus, OH to support an upcoming proposal effort. This contingent position requires eligibility for a DoD Top Secret clearance and IT-I/ Tier 5 at proposal submission.

The role focuses on researching and developing threat-detection use cases, scripting for SIEM enhancements, data-feed quality, and collaboration with stakeholders to prioritize alerts. The candidate will work with cybersecurity tool SMEs to fill gaps in protection, create signatures

Qualifications

• Five years of relevant IT experience.
• Three years of SIEM experience in content development or incident response.
• Three years of system and/or network administration experience.
• Understanding of various log formats.
• Understanding of the MITRE ATT&CK framework.
• Strong understanding of network architecture.
• Experience developing and maintaining scripts using PowerShell, Python, or SPL.
• Understanding of defense-in-depth concepts.

Responsibilities

• Researches and develops new threat detection use cases based on emerging threats and threat intel.
• Collaborates with stakeholders and tool SMEs to identify gaps and prioritize analytics.
• Develops custom scripts to enhance SIEM functionality.
• Reviews data feeds quality and implements improvements.
• Identifies critical systems, establishes alerting priorities, and creates tailored signatures.

Skills

IT experience

SIEM experience

Sys/Net admin

Log formats

MITRE ATT&CK

Network architecture

Scripting (PowerShell/Python/SPL)

Defense-in-Depth

Job description

BMA is seeking a SIEM Content Developer in Columbus, OH to support an upcoming proposal effort. This contingent position requires eligibility for a DoD Top Secret clearance and IT-I/ Tier 5 at proposal submission.

The role focuses on researching and developing threat-detection use cases, scripting for SIEM enhancements, data-feed quality, and collaboration with stakeholders to prioritize alerts. The candidate will work with cybersecurity tool SMEs to fill gaps in protection, create signatures