SIEM Content Engineer for Threat Detection & Automation

AGE Solutions; Columbus (OH); On-site; USD 115,000 - 135,000; Full time

Benefits offered by this job

Paid Leave

Bonuses

401k Match

Life Insurance

Health Plans

Parental Leave

Military Pay

Tuition Reimbursement

Growth & Training

Shared Success

Job summary

AGE Solutions seeks an experienced SIEM Content Developer to advance threat detection by building and enhancing SIEM content, researching threats, and developing custom scripts. You will work with stakeholders and tool SMEs to improve data feeds, alerting priorities, and detection signatures for critical systems and applications.

The role requires DoD Top Secret clearance with IT-I, T5 and at least one IAT-II certification as well as CSSP IR/A certifications.

Qualifications

• Five (5) years of relevant IT experience.
• Three (3) years of experience working with a SIEM in a content development or Incident Response role.
• Three (3) years of System and/or Network Administration experience.
• Must possess a current DoD Top Secret Clearance with IT-I, T5 investigation.
• Must have at least one IAT-II Certification: CCNA Security, CySA+, GICSP, GSEC, Security+ CE, SSCP.
• Must have at least one CSSP IR / CSSP A certification: CEH, CFR, CySA+, GCIA, GCIH, GICSP, SCYBER, GCFA.

Responsibilities

• Research and develop new threat detection use cases based on emerging threats, threat intelligence, and Threat Detection Analyst feedback.
• Collaborate with stakeholders and cybersecurity tool SMEs to identify gaps in security protection and analytics capabilities.
• Develop custom scripts to enhance SIEM functionality and threat detection capabilities.
• Review the quality of SIEM data feeds and recommend or implement improvements.
• Collaborate with stakeholders to identify critical systems and application components.
• Develop alerting priorities based on identified critical systems and application components.
• Create signatures tailored to individual programs and applications.
• Develop and maintain scripts using PowerShell, Python, SPL, or similar scripting capabilities identified for the role.
• Apply knowledge of MITRE ATT&CK framework and log formats when developing threat detection use cases.
• Apply understanding of network architecture and Defense-in-Depth in security analytics.

Skills

Threat detection

SIEM content

MITRE ATT&CK

Network architecture

PowerShell

Python

SPL

Defense-in-Depth

Log formats

Education

DoD Top Secret Clearance with IT-I, T5

IAT-II Certification (CCNA Security; CySA+; GICSP; GSEC; Security+ CE; SSCP)

CSSP IR / CSSP A certifications (CEH; CFR; CySA+; GCIA; GCIH; GICSP; SCYBER; GCFA)

Job description

AGE Solutions seeks an experienced SIEM Content Developer to advance threat detection by building and enhancing SIEM content, researching threats, and developing custom scripts. You will work with stakeholders and tool SMEs to improve data feeds, alerting priorities, and detection signatures for critical systems and applications.

The role requires DoD Top Secret clearance with IT-I, T5 and at least one IAT-II certification as well as CSSP IR/A certifications.