SIEM Content Developer

Agecareers; Columbus (OH); On-site; USD 115,000 - 135,000; Full time

Benefits offered by this job

26 Days Paid Leave

Performance Bonuses

401(k) with Match

Health Benefits

Parental Leave

Military Differential Pay

Tuition reimbursement

Job summary

AGE Solutions is seeking an experienced SIEM Content Developer to support development and enhancement of cybersecurity threat detection capabilities. This role researches threats and threat intelligence to develop new detection use cases and develops custom scripts to enhance SIEM functionality.

The SIEM Content Developer collaborates with stakeholders and Threat Detection Analysts to improve data feeds, establish alerting priorities, and create signatures for critical systems and applications.

Qualifications

• Five years of IT experience.
• Three years with a SIEM in content development or IR.
• Three years of system and/or network administration.

Responsibilities

• Research and develop new threat detection use cases.
• Collaborate with stakeholders and SMEs to identify gaps in security protection and analytics.
• Develop custom scripts to enhance SIEM functionality and threat detection capabilities.
• Review SIEM data feeds and recommend improvements.
• Create detection signatures tailored to programs and applications.
• Develop and maintain scripts in PowerShell, Python, or SPL.
• Apply MITRE ATT&CK framework and defense-in-depth knowledge to detections.

Skills

SIEM

Threat detection

Scripting

Threat intelligence

Network security

Tools

PowerShell

Python

SPL

Job description

About Us

AGE Solutions is a premier technology and professional services company, providing in-depth consulting, advanced technology solutions, and essential services throughout the U.S. government, defense, and intelligence sectors. Prioritizing innovation and client-focused solutions, we assist major agencies in addressing intricate issues and ensuring a more secure future.

AGE Solutions is seeking an experienced SIEM Content Developer to support the development and enhancement of cybersecurity threat detection capabilities. This position researches emerging threats and threat intelligence to develop new detection use cases, identifies gaps in security protection and analytics capabilities, and develops custom scripts to enhance SIEM functionality.

The SIEM Content Developer works closely with stakeholders, cybersecurity tool SMEs, and Threat Detection Analysts to improve data feeds, establish alerting priorities, and create detection signatures tailored to critical systems, programs, and applications.

Responsibilities Include:

• Research and develop new threat detection use cases based on emerging threats, threat intelligence research, and Threat Detection Analyst feedback.
• Collaborate with stakeholders and cybersecurity tool Subject Matter Experts (SMEs) to identify gaps in security protection and analytics capabilities.
• Develop custom scripts to enhance SIEM functionality and threat detection capabilities.
• Review the quality of SIEM data feeds and recommend or implement improvements.
• Collaborate with stakeholders to identify critical systems and application components.
• Develop alerting priorities based on identified critical systems and application components.
• Create signatures tailored to individual programs and applications.
• Develop and maintain scripts using PowerShell, Python, SPL, or similar scripting capabilities identified for the role.
• Apply knowledge of various log formats when developing and maintaining SIEM content.
• Apply knowledge of the MITRE ATT&CK framework when developing threat detection use cases.
• Apply knowledge of network architecture when developing security analytics and detection capabilities.
• Apply an understanding of Defense-in-Depth when supporting security protection and analytics capabilities.
• Independently assess material gaps in customer threat-detection coverage, compare alternative corrective approaches, and recommend priorities based on system criticality, security risk, and operational impact.
• Advise customer cybersecurity leadership on changes to detection practices and monitoring priorities, explaining the alternatives, tradeoffs, and expected effects on protection of critical systems and applications.

Required Skills, Qualifications, and Experience:

• Experience:
  • Five (5) years of relevant IT experience.
  • Three (3) years of experience working with a SIEM in a content development or Incident Response role.
  • Three (3) years of System and/or Network Administration experience.
• Clearance:
  • Must possess a current DoD Top Secret Clearance with IT-I, T5 investigation.
• Certifications:
  • Must have at least one IAT-II Certification:
    • Cisco Certified Network Associate Security (CCNA Security)
    • CompTIA Cybersecurity Analyst (CySA+)
    • Global Industrial Cyber Security Professional (GICSP)
    • GIAC Security Essentials (GSEC)
    • CompTIA Security+ Continuing Education (Security+ CE)
    • Systems Security Certified Practitioner (SSCP)
  • Must have at least one CSSP IR / CSSP A certification from the list of the following:
    • CSSP Analyst Certified Ethical Hacker (CEH)
    • CyberSec First Responder (CFR)
    • CompTIA Cybersecurity Analyst (CySA+)
    • GIAC Certified Intrusion Analyst (GCIA)
    • GIAC Certified Incident Handler (GCIH)
    • Global Industrial Cyber Security Professional (GICSP)
    • Cisco Cybersecurity Specialist (SCYBER)
    • GIAC Certified Forensic Analyst (GCFA)
• Skills and Qualifications:
  • Understanding of various log formats.
  • Understanding of the MITRE ATT&CK framework.
  • Strong understanding of network architecture.
  • Experience developing and maintaining scripts, preferably using PowerShell, Python, or SPL.
  • Understanding of Defense-in-Depth.
• Location:
  • This role is full-time onsite at our customer’s location in Columbus, OH.

Work Environment and Physical Demand:

• Work is primarily performed in a professional office or technical environment.
• Requires prolonged periods of sitting and working at a computer workstation.
• Requires frequent use of computers, keyboards, monitors, and standard office equipment.
• Requires the ability to communicate effectively with team members and stakeholders in person, by telephone, and through virtual collaboration tools.
• May require occasional standing, walking, bending, and reaching during the normal course of work.
• Requires the ability to maintain concentration and attention to detail while reviewing security data, threat intelligence, log information, and SIEM content.
• Must be able to work effectively in a collaborative environment with stakeholders, cybersecurity tool SMEs, and Threat Detection Analysts.

The projected salary range for this position is $115,000+ annually. Final compensation will be determined based on factors including years of relevant experience, active security clearance level, certifications, technical skillset, contract requirements, and overall qualifications.

At AGE Solutions, we reward performance, invest in growth, and share success. Our benefits support the whole person, professionally, financially, and personally.

• 26 Days Paid Leave: Includes vacation, sick, personal time, and holidays. You choose how to use it.
• Performance Bonuses: Performance bonuses are awarded based on individual contributions and company-wide results, aligning recognition with impact.
• 401(k) with Match: We match 3% of your contributions with immediate vesting.
• Financial Protection: Company-paid life insurance up to $300K and options for additional coverage for you and your dependents.
• Health Benefits: Multiple medical plans, dental, vision, FSA and HSA options to fit your needs.
• Parental Leave: 15 days of fully paid leave for new parents, because family matters.
• Military Differential Pay: We bridge the gap for employees on active duty, so they don’t take a financial hit while serving.
• Professional Growth: Paid training and certifications, tuition reimbursement, and the tools and tech to get the job done right.
• Shared Success: In the event of a company sale, our CEO has committed to returning 80% of net proceeds to employees. This ensures our team shares in the long term value they help create.

At AGE, you’ll do work that matters, supported by a company that delivers for its people.