SIEM Content Developer (Ohio)

Markesman Group; Whitehall (OH); On-site; USD 110,000 - 170,000; Full time

Job summary

Markesman Group is seeking a seasoned cyber threat analyst to research and develop threat-detection use cases and SIEM content based on intel and IR feedback. You will analyze logs, review data feeds, and map content to MITRE ATT&CK while collaborating with SMEs.

This role requires 5+ years in IT, 3+ years with a SIEM in content development or IR, DoD Top Secret clearance, and readiness to work in a sensitive environment to defend enterprise networks.

Qualifications

• 5+ years of IT experience.
• 3+ years with a SIEM in content development or IR roles.
• 3+ years of System Administration and/or Network Administration experience.
• Understanding of various log formats.
• Understanding of the MITRE ATT&CK framework.
• Current DoD Top Secret clearance; eligible for IT-I Tier 5.

Responsibilities

• Research and develop new threat-detection use cases based on emerging threats and cyber threat intelligence.
• Develop SIEM detection content based on feedback from Incident Response and Threat Detection analysts.
• Identify gaps in security monitoring, protection, and analytics capabilities.
• Develop and maintain custom scripts to enhance SIEM functionality.
• Review the quality and effectiveness of security data feeds.
• Recommend and implement improvements to SIEM data ingestion and detection content.
• Develop alerting priorities for critical systems and applications.
• Create signatures and detection logic tailored to individual programs and applications.
• Collaborate with cybersecurity tool SMEs, engineers, analysts, and mission stakeholders.
• Analyze network architecture and log sources to develop appropriate detection strategies.
• Map detection content and adversary behavior to MITRE ATT&CK.
• Support Defense-in-Depth through improved enterprise detection capabilities.

Skills

MITRE ATT&CK

Network architecture

Log formats

Defense-in-Depth

Threat detection concepts

Education

Tools

PowerShell

Python

SPL

Job description

Responsibilities:

• Research and develop new threat-detection use cases based on emerging threats and cyber threat intelligence
• Develop SIEM detection content based on feedback from Incident Response and Threat Detection analysts
• Identify gaps in security monitoring, protection, and analytics capabilities
• Develop and maintain custom scripts to enhance SIEM functionality
• Review the quality and effectiveness of security data feeds
• Recommend and implement improvements to SIEM data ingestion and detection content
• Develop alerting priorities for critical systems and applications
• Create signatures and detection logic tailored to individual programs and applications
• Collaborate with cybersecurity tool SMEs, engineers, analysts, and mission stakeholders
• Analyze network architecture and log sources to develop appropriate detection strategies
• Map detection content and adversary behavior to MITRE ATT&CK
• Support Defense-in-Depth through improved enterprise detection capabilities

Qualifications:

• 5+ years of relevant IT experience
• 3+ years working with a SIEM in a content-development or Incident Response role
• 3+ years of System Administration and/or Network Administration experience
• Understanding of various log formats
• Understanding of the MITRE ATT&CK framework
• Strong understanding of network architecture
• Experience developing and maintaining scripts, preferably using PowerShell, Python, or SPL
• Understanding of Defense-in-Depth
• Current DoD Top Secret clearance
• Eligible for IT-I Critical Sensitive / Tier 5 (T5) at proposal submission

About the Organization About Markesman Group Markesman Group has gathered the nation's foremost experts in Cyber, ISR, Enterprise IT and Intelligence Analysis. We seek to lead with cutting edge technology, high quality development and best value services for both the government and commercial sectors. Our team combines passion, acumen, focus, patriotism, desire, dedication and the love for the job to create value for our customers. We pride ourselves in a rigorous selection process because not only do we want the best, we want the best to want us. Working closely together as part of a service-disabled veteran owned small business, we enjoy a family environment where teammates challenge and elevate each other every day. The Markesman family is always striving to solve tomorrow's problems, today.

EOE Statement We are an Equal Opportunity/Affirmative Action Employer. We consider applicants without regard to race, color, religion, age, national origin, ancestry, ethnicity, gender, gender identity, gender expression, sexual orientation, marital status, veteran status, disability, genetic information, citizenship status, or membership in any other group protected by federal, state, or local law. EOE/M/F/Vet/Disabled.

This position is currently accepting applications.