SIEM & UEBA Engineer (Mid) – Threat Detection

Socket.dev; Washington (District of Columbia); Hybrid; USD 125,000 - 165,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

401(k) with company matching

Flexible spending accounts

Paid time off

Paid holidays

Job summary

Koniag Data Solutions, a Koniag Government Services company, is seeking an experienced SIEM/UEBA Engineer (Mid) to support enterprise cybersecurity operations for a federal client. Primary work will be at the client site in Washington, DC, with approved remote/telework options.

The role focuses on engineering, administering, and continuously improving SIEM and UEBA platforms, building high‑fidelity detection content, and supporting threat detection and incident response across on‑prem and cloud

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Systems, or related field.
• 3–5 years of hands‑on experience in SIEM engineering, security operations, or a closely related cybersecurity discipline within a federal government IT contracting or enterprise security environment.
• Hands‑on experience administering and engineering enterprise SIEM platforms, including log source onboarding, parser development, detection rule creation, alert tuning, and platform administration.
• Experience developing detection content aligned with the MITRE ATT&CK framework, including correlation rules, behavioral analytics, and threshold‑based alerting.
• Experience with log ingestion architecture design, including the onboarding and normalization of diverse log source types across endpoint, network, application, cloud, and identity platforms.
• Active security clearance or the ability to obtain and maintain a government background investigation and all requisite IT access authorizations.

Responsibilities

• SIEM Platform Engineering & Administration: administer, engineer, and maintain the enterprise SIEM platform; design and maintain log ingestion architectures; develop onboarding docs and runbooks; monitor health and capacity; manage access controls; support upgrades and changes; document architecture.
• UEBA Platform Engineering & Administration: integrate data sources, model baselines, tune risk scores and anomalies; develop UEBA use cases for insider threats and credential abuse; monitor health and documentation.
• Detection Engineering & Content Development: design and tune detection rules and queries aligned with MITRE ATT&CK; conduct coverage assessments; develop content for high‑priority threat scenarios; perform tuning to reduce false positives.
• Log Source Management & Data Normalization: maintain log source inventory; develop custom parsers and mappings; ensure data quality and onboarding of new sources.
• Security Analytics & Threat Intelligence Integration: develop analytics, ingest threat intel, enrich alerts, support threat hunting and investigate findings.
• Incident Investigation Support: provide targeted queries, timelines, and playbooks; develop dashboards; support post‑incident reviews.
• Reporting, Metrics & Documentation: produce performance metrics, executive reports, and engineering docs; support metrics dashboards.
• Compliance & ATO Support: ensure configurations comply with federal frameworks; support SSP and continuous monitoring.

Skills

SIEM engineering

Security operations

UEBA administration

Incident investigation support

Threat detection

Education

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Information Systems, or related field

Tools

Splunk

Microsoft Sentinel

IBM QRadar

Elastic SIEM

Job description

Koniag Data Solutions, a Koniag Government Services company, is seeking an experienced SIEM/UEBA Engineer (Mid) to support enterprise cybersecurity operations for a federal client. Primary work will be at the client site in Washington, DC, with approved remote/telework options.

The role focuses on engineering, administering, and continuously improving SIEM and UEBA platforms, building high‑fidelity detection content, and supporting threat detection and incident response across on‑prem and cloud