Threat-Focused SIEM Content Developer

Markesman Group; Whitehall (OH); On-site; USD 110,000 - 170,000; Full time

Job summary

Markesman Group is seeking a seasoned cyber threat analyst to research and develop threat-detection use cases and SIEM content based on intel and IR feedback. You will analyze logs, review data feeds, and map content to MITRE ATT&CK while collaborating with SMEs.

This role requires 5+ years in IT, 3+ years with a SIEM in content development or IR, DoD Top Secret clearance, and readiness to work in a sensitive environment to defend enterprise networks.

Qualifications

• 5+ years of IT experience.
• 3+ years with a SIEM in content development or IR roles.
• 3+ years of System Administration and/or Network Administration experience.
• Understanding of various log formats.
• Understanding of the MITRE ATT&CK framework.
• Current DoD Top Secret clearance; eligible for IT-I Tier 5.

Responsibilities

• Research and develop new threat-detection use cases based on emerging threats and cyber threat intelligence.
• Develop SIEM detection content based on feedback from Incident Response and Threat Detection analysts.
• Identify gaps in security monitoring, protection, and analytics capabilities.
• Develop and maintain custom scripts to enhance SIEM functionality.
• Review the quality and effectiveness of security data feeds.
• Recommend and implement improvements to SIEM data ingestion and detection content.
• Develop alerting priorities for critical systems and applications.
• Create signatures and detection logic tailored to individual programs and applications.
• Collaborate with cybersecurity tool SMEs, engineers, analysts, and mission stakeholders.
• Analyze network architecture and log sources to develop appropriate detection strategies.
• Map detection content and adversary behavior to MITRE ATT&CK.
• Support Defense-in-Depth through improved enterprise detection capabilities.

Skills

MITRE ATT&CK

Network architecture

Log formats

Defense-in-Depth

Threat detection concepts

Education

Tools

PowerShell

Python

SPL

Job description

Markesman Group is seeking a seasoned cyber threat analyst to research and develop threat-detection use cases and SIEM content based on intel and IR feedback. You will analyze logs, review data feeds, and map content to MITRE ATT&CK while collaborating with SMEs.

This role requires 5+ years in IT, 3+ years with a SIEM in content development or IR, DoD Top Secret clearance, and readiness to work in a sensitive environment to defend enterprise networks.