Detection Engineer (SIEM/SOAR)
TypeContract
LocationUnited States
Posted1 hour ago
Description
Dragonfli Group is a cybersecurity and IT consulting firm providing services to federal agencies and Fortune 100 enterprises. Headquartered in Washington, DC, Dragonfli supports clients in securing mission-critical systems across on-site, hybrid, and fully remote environments.
We are seeking a Cyber Threat Analyst to join the Detection and Automation Engineering (DAE) program within the security operations organization of a large federal agency. In this role you will design, implement, and maintain automated and AI-driven security detection and integration capabilities across enterprise security monitoring technologies. You will turn operational security needs into working detections and workflows, using SIEM, EDR, SOAR, and threat intelligence platforms (including Splunk Enterprise Security, Splunk SOAR, and SentinelOne), and Python, PowerShell, and Bash. You will work closely with SOC, threat intelligence, and incident response teams, and your documentation and operationalization discipline will keep detections reliable over time. The role calls for 8+ years of relevant cybersecurity experience in detection engineering, security operations, or a closely related field.
This is a multi-year contract position involving a large US federal agency. Candidates with previous federal contracting experience are preferred. U.S. Citizenship or Permanent Residency is required. If hired, all work related to this role must be performed within the continental U.S.
Responsibilities
Detection engineering and automation: build automation, AI-driven ("Super Intelligence"/SI), and integration workflows that improve detection and response.
Security platform integration: integrate and optimize SIEM, EDR, SOAR, and threat intelligence technologies into a cohesive detection architecture.
Requirements to implementation: analyze requirements and translate operational security needs into technical specifications and implementable solutions.
Testing and validation: test, evaluate, and validate detections and automation workflows, and drive continuous improvement from results and operational feedback.
Security data analysis: analyze telemetry to identify anomalies, trends, and detection gaps, then recommend and implement detection enhancements.
Documentation and sustainment: create and maintain technical documentation, SOPs, and runbooks that support reliable operations.
Cross-functional coordination: work with SOC, threat intelligence, and incident response teams to align detections to threat priorities and operational processes.
Emerging capability evaluation: research and assess new security and AI/ML capabilities that enhance detection effectiveness.
Requirements
Must-Have
3-8+ years of relevant cybersecurity experience in detection engineering, SOC operations, or security automation (inferred; see Recruiter Notes)
Bachelor's degree in a relevant field, or four additional years of relevant experience in lieu of a degree
U.S. Citizenship or Permanent Residency, with all work performed within the continental U.S.
CompTIA Security+ (or equivalent baseline certification)
One of: GCIA, GCIH, or CompTIA CySA+
Programming/scripting certification or demonstrated proficiency (Python, PowerShell, or similar)
Hands-on experience with SIEM and SOAR platforms, such as Splunk Enterprise Security, Splunk SOAR, SentinelOne, and SentinelOne Hyperautomation
Working knowledge of detection engineering methodologies, SOC operations, and incident response
Working knowledge of NIST SP 800-53, CIS Controls, and the MITRE ATT&CK framework
Experience building and maintaining technical documentation, SOPs, and runbooks
Preferred / Nice-to-Have
CISSP or GIAC Security Essentials (GSEC)
CompTIA SecAI+
GMON or a similar continuous monitoring/detection-focused certification
Prior federal contracting experience
Familiarity with NICE Framework, ISO 27001/27002, FISMA, FedRAMP, OMB circulars and federal cybersecurity directives, and the Privacy Act
Experience with malware analysis, digital forensics procedures, and risk assessment methodologies
Experience applying machine learning and AI to security detection
Skill(s)
Technical Skills
SIEM, EDR, and SOAR platforms: Splunk Enterprise Security, Splunk SOAR, SentinelOne, SentinelOne Hyperautomation
Detection engineering methodologies and detection content development and tuning
Security automation and orchestration concepts, including AI/ML-enabled security ("Super Intelligence"/SI)
Programming and scripting: Python, PowerShell, Bash
API integration and development
SOC operations and processes
Threat intelligence lifecycle and analysis
Incident response methodologies
Network protocols and architecture
Operating systems: Windows, Linux, Unix
Cloud platforms: AWS, Azure, GCP
Security architecture and design
Security telemetry and data analysis
Frameworks and standards: NIST SP 800-53, CIS Controls, MITRE ATT&CK
Soft Skills
Clear technical writing for documentation, SOPs, and runbooks
Cross-functional collaboration with SOC, threat intelligence, and incident response teams
Requirements analysis and translating operational needs into technical specifications
Analytical, detail-oriented problem solving
Continuous-improvement mindset driven by testing results and operational feedback
Curiosity and initiative in evaluating emerging security and AI/ML capabilities
Benefits
Medical — Multiple POS health plan options including an HSA-compatible plan
Dental — PPO coverage for preventive, basic, and major services
Vision — Annual exam, frames, lenses, and contact lens allowance
401(k) — Employer match up to 5% of eligible compensation
Long-Term Disability — 100% employer-paid coverage at 50% of pre-disability earnings
Life Insurance & AD&D — 100% employer-paid coverage valued at $10,000 each
PTO — 15–25 days annually based on tenure
Paid Federal Holidays — All 11 federal holidays observed
Originally posted on Himalayas
Dragonfli Group is a cybersecurity and IT consulting firm providing services to federal agencies and Fortune 100 enterprises. Headquartered in Washington, DC, Dragonfli supports clients in securing mission-critical systems across on-site, hybrid, and fully remote environments.
We are seeking a Cyber Threat Analyst to join the Detection and Automation Engineering (DAE) program within the security operations organization of a large federal agency. In this role you will design, implement, and maintain automated and AI-driven security detection and integration capabilities across enterprise security monitoring technologies. You will turn operational security needs into working detections and workflows, using SIEM, EDR, SOAR, and threat intelligence platforms (including Splunk Enterprise Security, Splunk SOAR, and SentinelOne), and Python, PowerShell, and Bash. You will work closely with SOC, threat intelligence, and incident response teams, and your documentation and operationalization discipline will keep detections reliable over time. The role calls for 8+ years of relevant cybersecurity experience in detection engineering, security operations, or a closely related field.
This is a multi-year contract position involving a large US federal agency. Candidates with previous federal contracting experience are preferred. U.S. Citizenship or Permanent Residency is required. If hired, all work related to this role must be performed within the continental U.S.
Responsibilities
Detection engineering and automation: build automation, AI-driven ("Super Intelligence"/SI), and integration workflows that improve detection and response.
Security platform integration: integrate and optimize SIEM, EDR, SOAR, and threat intelligence technologies into a cohesive detection architecture.
Requirements to implementation: analyze requirements and translate operational security needs into technical specifications and implementable solutions.
Testing and validation: test, evaluate, and validate detections and automation workflows, and drive continuous improvement from results and operational feedback.
Security data analysis: analyze telemetry to identify anomalies, trends, and detection gaps, then recommend and implement detection enhancements.
Documentation and sustainment: create and maintain technical documentation, SOPs, and runbooks that support reliable operations.
Cross-functional coordination: work with SOC, threat intelligence, and incident response teams to align detections to threat priorities and operational processes.
Emerging capability evaluation: research and assess new security and AI/ML capabilities that enhance detection effectiveness.
Requirements
Must-Have
3-8+ years of relevant cybersecurity experience in detection engineering, SOC operations, or security automation (inferred; see Recruiter Notes)
Bachelor's degree in a relevant field, or four additional years of relevant experience in lieu of a degree
U.S. Citizenship or Permanent Residency, with all work performed within the continental U.S.
CompTIA Security+ (or equivalent baseline certification)
One of: GCIA, GCIH, or CompTIA CySA+
Programming/scripting certification or demonstrated proficiency (Python, PowerShell, or similar)
Hands-on experience with SIEM and SOAR platforms, such as Splunk Enterprise Security, Splunk SOAR, SentinelOne, and SentinelOne Hyperautomation
Working knowledge of detection engineering methodologies, SOC operations, and incident response
Working knowledge of NIST SP 800-53, CIS Controls, and the MITRE ATT&CK framework
Experience building and maintaining technical documentation, SOPs, and runbooks
Preferred / Nice-to-Have
CISSP or GIAC Security Essentials (GSEC)
CompTIA SecAI+
GMON or a similar continuous monitoring/detection-focused certification
Prior federal contracting experience
Familiarity with NICE Framework, ISO 27001/27002, FISMA, FedRAMP, OMB circulars and federal cybersecurity directives, and the Privacy Act
Experience with malware analysis, digital forensics procedures, and risk assessment methodologies
Experience applying machine learning and AI to security detection
Skill(s)
Technical Skills
SIEM, EDR, and SOAR platforms: Splunk Enterprise Security, Splunk SOAR, SentinelOne, SentinelOne Hyperautomation
Detection engineering methodologies and detection content development and tuning
Security automation and orchestration concepts, including AI/ML-enabled security ("Super Intelligence"/SI)
Programming and scripting: Python, PowerShell, Bash
API integration and development
SOC operations and processes
Threat intelligence lifecycle and analysis
Incident response methodologies
Network protocols and architecture
Operating systems: Windows, Linux, Unix
Cloud platforms: AWS, Azure, GCP
Security architecture and design
Security telemetry and data analysis
Frameworks and standards: NIST SP 800-53, CIS Controls, MITRE ATT&CK
Soft Skills
Clear technical writing for documentation, SOPs, and runbooks
Cross-functional collaboration with SOC, threat intelligence, and incident response teams
Requirements analysis and translating operational needs into technical specifications
Analytical, detail-oriented problem solving
Continuous-improvement mindset driven by testing results and operational feedback
Curiosity and initiative in evaluating emerging security and AI/ML capabilities
Benefits
Medical — Multiple POS health plan options including an HSA-compatible plan
Dental — PPO coverage for preventive, basic, and major services
Vision — Annual exam, frames, lenses, and contact lens allowance
401(k) — Employer match up to 5% of eligible compensation
Long-Term Disability — 100% employer-paid coverage at 50% of pre-disability earnings
Life Insurance & AD&D — 100% employer-paid coverage valued at $10,000 each
PTO — 15–25 days annually based on tenure
Paid Federal Holidays — All 11 federal holidays observed
Originally posted on Himalayas
Apply on Himalayas →
Job sourced from Himalayas. Applications happen directly on the original platform — we never collect your data.