SIEM Detection Engineer (DoD TS Clearance)

MartinFed; Washington (District of Columbia); On-site; USD 110,000 - 160,000; Full time

Job summary

MartinFed is seeking an SIEM Detection Engineer to develop, tune, and maintain Splunk-based detections for government-focused security operations. You will own correlation searches, alerts, and use cases aligned to MITRE ATT&CK, leveraging threat intelligence to minimize noise while maximizing coverage.

The role collaborates with security analysts, threat intel teams, and platform engineers to ensure precise detection, validated content, and actionable dashboards for SOC triage and investigation

Qualifications

• Detection development in SPL: correlation searches, scheduled searches, alerts, and thresholds.
• Security use case design mapped to MITRE ATT&CK.
• Alert tuning and false-positive reduction while maintaining coverage.
• Threat intelligence application and IOC/behavioral detection logic.
• Dashboard and visualization development for SOC triage and investigation.
• Detection testing and validation against known attack techniques and sample data.
• Working knowledge of Splunk Enterprise Security (ES): notable events, risk-based alerting (RBA), and data models.
• Understanding of the incident response lifecycle and SOC workflows.
• Familiarity with adversary tactics, techniques, and common attack patterns across endpoint, network, and cloud.

Responsibilities

• Detection Development: Develop and optimize search queries, correlation searches, and SPL alerts.
• Use Case Development: Design security use cases mapped to MITRE ATT&CK and drive by threat intel.
• Alert Tuning: Reduce false positives while preserving coverage and relevance.
• Dashboards & Visualization: Build dashboards for SOC triage and investigation.
• Threat Detection Support: Monitor events and provide detection context for incident response.
• Detection Testing & Validation: Test detections with known techniques and document outcomes.
• Collaboration & Documentation: Coordinate with analysts and threat intel; maintain runbooks and docs.

Skills

Detection SPL development

MITRE ATT&CK mapping

Alert tuning

Threat intelligence

SOC dashboards

Detections testing

Splunk ES basics

IR lifecycle knowledge

Threat patterns across tech

Job description

Company Overview

Founded in 2007 in Huntsville, AL, MartinFed provides the U.S. government with customer-focused, performance-based solutions using technology and an empowered workforce as an engine to drive its customers' missions. Our goal is to attract the best and brightest within their field.

Company Overview

Founded in 2007 in Huntsville, AL, MartinFed provides the U.S. government with customer-focused, performance-based solutions using technology and an empowered workforce as an engine to drive its customers' missions. Our goal is to attract the best and brightest within their field.

We Invest In Our People Because They Are Our Greatest Asset. They Cultivate Our Purpose, Embody And Reflect Our Core Values, And Define Our Culture. MartinFed's Core Values That Set Us Apart Are The Following

• Be Driven - We are fueled by the hunger to learn more and do more.
• Be Curious - We engage in continuous improvement - never accepting the status quo.
• Be Humble - We seek honest feedback to strengthen our relationships.
• Pursue Excellence - We strive to achieve extraordinary results and do not settle for mediocrity.

Strive for excellence and consider joining our growing team today!

Job Overview

The SIEM Detection Engineer is responsible for developing, tuning, and maintaining the detection content that identifies security threats within government agencies. This role owns correlation searches, alerts, and security use cases built in Splunk, aligning detections to frameworks such as MITRE ATT&CK and incorporating threat intelligence. The Detection Engineer works closely with security analysts, threat intelligence teams, and the Data and Platform Engineers to ensure threats are detected accurately and with minimal noise.

Essential Functions

• Detection Development
  • Develop and optimize search queries, correlation searches, and alerts in SPL to proactively detect security threats, anomalies, and suspicious behavior.
  • Configure alerts to trigger automated responses or notifications based on predefined criteria.
• Use Case Development
  • Design and implement security use cases mapped to MITRE ATT&CK and driven by threat intelligence and agency risk priorities.
  • Translate threat scenarios and requirements into actionable, testable detection logic.
• Alert Tuning and Optimization
  • Tune detections to reduce false positives and alert fatigue while maintaining coverage.
  • Continuously review and refine detection performance against evolving threats.
• Dashboards and Visualization
  • Design and build dashboards and visualizations that support SOC triage, investigation, and decision-making.
  • Present detection results and metrics in a clear, actionable manner.
• Threat Detection and Response Support
  • Monitor and analyze security-related events to detect and help respond to potential threats.
  • Support incident response by providing detection context and refining content based on findings.
• Detection Testing and Validation
  • Test and validate detections against known attack techniques and sample data before deployment.
  • Document detection logic, coverage, and expected outcomes.
• Collaboration and Documentation
  • Collaborate with security analysts and threat intelligence teams to align detections with operational needs.
  • Maintain documentation and runbooks for detection content and response guidance.

Qualifications

• Detection development in SPL: correlation searches, scheduled searches, alerts, and thresholds
• Security use case design mapped to MITRE ATT&CK
• Alert tuning and false-positive reduction while maintaining coverage
• Threat intelligence application and IOC/behavioral detection logic
• Dashboard and visualization development for SOC triage and investigation
• Detection testing and validation against known attack techniques and sample data
• Working knowledge of Splunk Enterprise Security (ES): notable events, risk-based alerting (RBA), and data models
• Understanding of the incident response lifecycle and SOC workflows
• Familiarity with adversary tactics, techniques, and common attack patterns across endpoint, network, and cloud

Physical Requirements & Environmental Conditions

• Inside office environment.
• Working on a computer for long periods of time.
• May involve long period of sitting at a desk.
• The work environment is fast-paced and sometimes involves extreme deadline pressures.

Other Duties

This job description is not designed to cover or contain a comprehensive listing of activities, duties or responsibilities that are required of the employee for this job. Duties, responsibilities, and activities may change at any time with or without notice.

MartinFed is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regards to race, color, religion, religious creed, gender, sexual orientation, gender identity, gender expression, transgender, pregnancy, marital status, national origin, ancestry, citizenship status, age, disability, protected Veteran Status, genetics or any other characteristics protected by applicable federal, state or local law. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. In addition to federal law requirements, MartinFed complies with all applicable state and local laws governing nondiscrimination in all locations.

If you are a qualified individual with a disability or disabled veteran, you have the right to request a reasonable accommodation if you are unable or limited in your ability to use or access MartinFed's current openings as a result of your disability. You can request reasonable accommodations by calling 855.212.1810. Thank you for your interest in MartinFed.