Threat Detection Analyst — Splunk ES & MITRE Expert

Peraton; Beltsville (MD); On-site; USD 80,000 - 128,000; Full time

Job summary

Peraton is seeking a Cyber Monitoring Signature Analyst for the DoS DSCM program, with a primary role in Rosslyn, VA and a secondary site in Beltsville, MD. The position operates Monday–Friday, 08:00–16:00, within the Cyber Incident Response Team.

You will author and tune SPL searches, maintain MITRE ATT&CK coverage, and coordinate with engineers to strengthen threat detection capabilities. You will evaluate new detections, implement CORR searches, and report on detection metrics while

Qualifications

• Bachelor's degree and 2 years of relevant experience; or, 0 years with a Masters degree.
• Certification: CCNA-Security, CND, CySA+, GICSP, GSEC, Security+ CE, SSCP.
• Hands-on SPL authoring and tuning in production Splunk (≥3 years).
• Working knowledge of Splunk Enterprise Security; ES 8.x preferred.
• Experience modifying Splunk ES searches, macros, and lookups.
• Familiarity with MITRE ATT&CK and its application to detection engineering.
• Working knowledge of Zeek, Suricata, and at least one EDR.
• Incident Response Lifecycle knowledge across cloud/legacy/hybrid environments.

Responsibilities

• Work with senior engineers to build and enhance threat detection and response capabilities.
• Protect global IT infrastructure against advanced threats.
• Author, tune, and maintain correlation searches, risk notables, and Adaptive Response in Splunk.
• Evaluate new detections and incorporate vetted alerting into SIEM.
• Provide reporting on detection development metrics.

Skills

SPL searches

Splunk ES

MITRE ATT&CK

CIM

EDR experience

Python/Regex

Threat intelligence

Incident response

Communication

Clearance awareness

Education

Bachelor's degree

Master's degree substitute

Tools

Splunk ES

Splunk Cloud

Zeek

Suricata

EDR tools

Python

Job description

Peraton is seeking a Cyber Monitoring Signature Analyst for the DoS DSCM program, with a primary role in Rosslyn, VA and a secondary site in Beltsville, MD. The position operates Monday–Friday, 08:00–16:00, within the Cyber Incident Response Team.

You will author and tune SPL searches, maintain MITRE ATT&CK coverage, and coordinate with engineers to strengthen threat detection capabilities. You will evaluate new detections, implement CORR searches, and report on detection metrics while