Threat Detection Engineer — SIEM Signatures (TS/SCI, Onsite)

RISA; St. Louis (MO); On-site; USD 78,000 - 86,000; Full time

Job summary

Rolston Information Systems Assurance (RISA) in St. Louis, MO, is seeking a Cyber Threat Detection Engineer (SIEM/Signatures) on-site. You will craft and tune detection logic, analyze incidents, and run Purple Team exercises to outpace adversaries.

Active TS/SCI clearance and the ability to obtain a polygraph are required. Required is a Bachelor's degree with 6+ years of relevant experience (or equivalent), DoD 8140/8570-M IAT III/CSSP Analyst certification, and strong data-mining, regex, and

Qualifications

• U.S. citizenship and an active TS/SCI.
• Ability to successfully obtain and maintain a Government polygraph after hire.
• Bachelor's degree in a field applicable to the position plus 6 years of relevant experience; equivalents accepted - Master's +4, Associate +8, or High School diploma/GED +10.
• 8+ years of related advanced cyber security analytics experience.
• A certification compliant with DoD 8140.01 and 8570.01-M IAT Level III and CSSP Analyst.
• Data mining or query building in a SIEM.
• Strong signature development and tuning, and strong network protocol analysis with protocol analyzers.
• Static file signatures (magic numbers) and good working knowledge of regular expressions.

Responsibilities

• Analyze trends and patterns to identify and predict previously undiscovered events, then develop or tune the rules, signatures, and scripts that catch them.
• Turn intelligence and incident reporting into deployed detection logic.
• Run regular Purple Team exercises and continuously validate countermeasures already deployed.
• Work with the Cyber Data Analytics team on SIEM alert efficiency, evaluating valid alerts against false positives.
• Support the Cyber Incident Response Team during live activity, predicting adversary response and locations of compromise to assist triage.
• Document work in the authorized ticketing system so any stakeholder can reconstruct the analysis.

Skills

SIEM data mining

Signature development

Regex patterns

Network protocol analysis

Scripting (Python/Bash/PowerShell)

DoD 8140/8570-M IAT III CSSP Analyst

Education

Bachelor's degree + 6 years experience; Master’s +4; Associate +8; HS diploma + 10

Tools

Protocol analyzers

SIEM tooling

Job description

Rolston Information Systems Assurance (RISA) in St. Louis, MO, is seeking a Cyber Threat Detection Engineer (SIEM/Signatures) on-site. You will craft and tune detection logic, analyze incidents, and run Purple Team exercises to outpace adversaries.

Active TS/SCI clearance and the ability to obtain a polygraph are required. Required is a Bachelor's degree with 6+ years of relevant experience (or equivalent), DoD 8140/8570-M IAT III/CSSP Analyst certification, and strong data-mining, regex, and