Threat Detection Engineer: Build Rules & Hunt Threats

Rootedsec; Reston (VA); Hybrid; USD 115,000 - 145,000; Full time

Job summary

CACI International in Reston, VA is seeking a Detection Engineer to translate attacker techniques into production detection rules and to monitor security telemetry on real production data. You will build detections from real attacker behavior, measure false positives, and hunt for gaps that current detections would miss.

The role requires strong query and scripting skills, knowledge of attacker techniques, and willingness to manage, retire, or improve rules as needed.

Qualifications

• Knows what attacks look like in telemetry, not just in theory.
• Query languages and a scripting language.
• Willin g to delete your own rules when they stop earning their place.

Responsibilities

• Build detections from real attacker behaviour.
• Measure each rule's false positive rate and own it.
• Hunt for what current detections would have missed.

Skills

Threat detection

Query languages

Scripting

Rule management

Tools

Sigma rules

Job description

CACI International in Reston, VA is seeking a Detection Engineer to translate attacker techniques into production detection rules and to monitor security telemetry on real production data. You will build detections from real attacker behavior, measure false positives, and hunt for gaps that current detections would miss.

The role requires strong query and scripting skills, knowledge of attacker techniques, and willingness to manage, retire, or improve rules as needed.