Threat Detection Analyst — Splunk ES & MITRE Expert

Peraton; Beltsville (MD); On-site; USD 80,000 - 128,000; Full time

Job summary

Peraton is seeking a Cyber Monitoring Signature Analyst to join the DSCM program, based in Rosslyn, VA with a secondary site in Beltsville, MD. The role focuses on building and enhancing threat detection in a Splunk-based SIEM environment, collaborating with senior engineers and threat analysts to protect a global IT infrastructure.

The position requires hands-on SPL development, familiarity with Splunk ES, MITRE ATT&CK framework, and EDR tooling.

Qualifications

• Minimum 5 years of relevant experience with a Bachelor's degree, or 3 years with a Masters.

Responsibilities

• Author, tune, and maintain correlation searches, Risk Notables, and Adaptive Response actions in Splunk Cloud Enterprise Security.
• Evaluate new analytical detections from open-source libraries and incorporate vetted alerting into a SIEM.
• Author new correlational searches in SPL/SPL2 using best practice search methodologies.
• Maintain a living MITRE ATT&CK coverage matrix and identify gaps with SME.
• Ensure cohesion and health of SIEM alerting.
• Collaborate with system engineers on tool development, configuration, and tuning.
• Operationalize threat intelligence for actionable IOC detections.
• Provide reporting on detection development metrics.

Skills

SPL searches

Splunk Enterprise Security

MITRE ATT&CK

Python

EDR familiarity

Education

Bachelor's degree

Master's degree

Tools

Splunk

Splunk ES

MITRE ATT&CK

Zeek

Suricata

EDR

Job description

Peraton is seeking a Cyber Monitoring Signature Analyst to join the DSCM program, based in Rosslyn, VA with a secondary site in Beltsville, MD. The role focuses on building and enhancing threat detection in a Splunk-based SIEM environment, collaborating with senior engineers and threat analysts to protect a global IT infrastructure.

The position requires hands-on SPL development, familiarity with Splunk ES, MITRE ATT&CK framework, and EDR tooling.