SIEM Content Developer (Ohio)

Job Description

Responsibilities:

? Research and develop new threat-detection use cases based on emerging threats and cyber threat intelligence

? Develop SIEM detection content based on feedback from Incident Response and Threat Detection analysts

? Identify gaps in security monitoring, protection, and analytics capabilities

? Develop and maintain custom scripts to enhance SIEM functionality

? Review the quality and effectiveness of security data feeds

? Recommend and implement improvements to SIEM data ingestion and detection content

? Develop alerting priorities for critical systems and applications

? Create signatures and detection logic tailored to individual programs and applications

? Collaborate with cybersecurity tool SMEs, engineers, analysts, and mission stakeholders

? Analyze network architecture and log sources to develop appropriate detection strategies

? Map detection content and adversary behavior to MITRE ATT&CK

? Support Defense-in-Depth through improved enterprise detection capabilities

Qualifications:

? 5+ years of relevant IT experience

? 3+ years working with a SIEM in a content-development or Incident Response role

? 3+ years of System Administration and/or Network Administration experience

? Understanding of various log formats

? Understanding of the MITRE ATT&CK framework

? Strong understanding of network architecture

? Experience developing and maintaining scripts, preferably using PowerShell, Python, or SPL

? Understanding of Defense-in-Depth

? Current DoD Top Secret clearance

? Eligible for IT-I Critical Sensitive / Tier 5 (T5) at proposal submission

Full-time