Threat Detection Engineer — Splunk SIEM & MITRE ATT&CK

Peraton; Beltsville (MD); On-site; USD 80,000 - 128,000; Full time

Job summary

Peraton is seeking a Cyber Monitoring Signature Analyst to join the DoS DSCM program. The role is based in Rosslyn, VA with a secondary site at Beltsville, MD, and a standard Mon-Fri schedule. You will develop and tune SPL-based detections, work with senior engineers, and maintain SIEM health across global IT infrastructure.

Preferred candidates have Splunk ES experience, MITRE ATT&CK familiarity, and strong reporting skills. U.S.

Qualifications

• Hands-on experience authoring and tuning SPL in a production Splunk environment.

Responsibilities

• Author, tune, and maintain correlation searches, Risk Notables, and Adaptive Response actions within Splunk Cloud Enterprise Security.
• Evaluate new analytical detections from open-source libraries and incorporate vetted alerting into a SIEM.
• Author new correlational searches in SPL2 using best practice search methodologies.
• Maintain a living MITRE ATT&CK coverage matrix and identify gaps with SME.
• Ensure proper cohesion and health of SIEM alerting.
• Collaborate with system engineers on configuration and tuning of cyber security tools.
• Operationalize threat intelligence to ensure IOC are actionable in detections.
• Provide reporting on detection development metrics (coverage, MTTx, FP rate).

Skills

SPL searches

Splunk ES

MITRE ATT&CK

EDR

Incident Response

Communication

Security Lifecycle

Education

Bachelor's degree

Master's degree

Tools

Splunk Enterprise Security

Job description

Peraton is seeking a Cyber Monitoring Signature Analyst to join the DoS DSCM program. The role is based in Rosslyn, VA with a secondary site at Beltsville, MD, and a standard Mon-Fri schedule. You will develop and tune SPL-based detections, work with senior engineers, and maintain SIEM health across global IT infrastructure.

Preferred candidates have Splunk ES experience, MITRE ATT&CK familiarity, and strong reporting skills. U.S.