Threat Detection SIEM Content Developer

Enterprise Solutions & Management; Columbus (OH); On-site; USD 100,000 - 140,000; Full time

Job summary

Enterprise Solutions and Management is a government contractor delivering strategic IT services to Defense and Federal customers. We are hiring a SIEM Content Developer to design and implement threat detection use cases for an enterprise-level program in a federal environment.

You will collaborate with stakeholders and security SMEs, develop scripts to enhance SIEM capabilities, and adjust data feeds to improve detection and alerting.

Qualifications

• Five years of relevant IT experience.
• Three years with SIEM in a content development or incident response role.
• Three years of system and/or network administration experience.
• Must maintain CSSP Analyst certification (CEH, CFR, GCIA, GCISP).
• SIEM certification and Top Secret clearance.

Responsibilities

• Research and develop threat detection use cases based on emerging threats, threat intelligence, and analyst feedback.
• Collaborates with stakeholders and cybersecurity tool SMEs to identify gaps in security controls, analytics, and data quality.
• Develops custom scripts to enhance SIEM capabilities and improves data feeds to support effective detection.
• Identifies critical systems and application components to establish alerting priorities and develop tailored detection signatures.

Skills

Data analysis

Log formats

Network architecture

MITRE ATT&CK

Scripting: Python/PowerShell/SPL

Defense in Depth

Education

Five years IT experience

SIEM content development/IR experience

System/Network Administration

CSSP Analyst certification (CEH, CFR, GCIA, GCISP)

SIEM certification

Top Secret

Job description

Enterprise Solutions and Management is a government contractor delivering strategic IT services to Defense and Federal customers. We are hiring a SIEM Content Developer to design and implement threat detection use cases for an enterprise-level program in a federal environment.

You will collaborate with stakeholders and security SMEs, develop scripts to enhance SIEM capabilities, and adjust data feeds to improve detection and alerting.