Threat Hunter & Detection Engineer – Hybrid SIEM & Analytics

ECS; Arlington (VA); Hybrid; USD 170,000 - 190,000; Full time

Job summary

ECS Federal LLC is seeking a Detection Engineer / Threat Hunter in Arlington, VA (Hybrid) to proactively identify and mitigate advanced cyber threats. The role combines threat hunting, detection engineering, and security analytics to improve proactive defense across enterprise environments.

Responsibilities include developing detection content for SIEM/EDR/Cloud, leveraging MITRE ATT&CK, and supporting incident response with actionable insights and persistent improvements across security

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field.
• 7+ years of cybersecurity experience with Threat Hunting, Detection Engineering, SOC, or Incident Response.
• Strong understanding of attacker TTPs and threat frameworks (MITRE ATT&CK).

Responsibilities

• Conduct proactive threat hunting to identify malicious activity across networks, endpoints, cloud, and apps.
• Design, test, and maintain detection content for SIEM, EDR/XDR, NDR, and cloud platforms.
• Develop Sigma rules, YARA signatures, SIEM queries, and detection playbooks.
• Tune detections and define true-positive criteria to reduce noise.
• Analyze large security telemetry and correlate threat intelligence with internal data.
• Support Incident Response and post-incident detection enhancements.

Skills

Threat hunting

Detection engineering

Security analytics

Incident response

MITRE ATT&CK knowledge

Education

Bachelor's degree in Cybersecurity/CS/IT or related field

Tools

SIEM platforms

Threat intelligence tools

Job description

ECS Federal LLC is seeking a Detection Engineer / Threat Hunter in Arlington, VA (Hybrid) to proactively identify and mitigate advanced cyber threats. The role combines threat hunting, detection engineering, and security analytics to improve proactive defense across enterprise environments.

Responsibilities include developing detection content for SIEM/EDR/Cloud, leveraging MITRE ATT&CK, and supporting incident response with actionable insights and persistent improvements across security