DETECTION AND AUTOMATION ENGINEER

Detection and Automation Engineer

Position Overview

The Detection and Automation Engineer develops, tests, tunes, maintains, and documents the analytics, detections, dashboards, scripts, interfaces, and automation that support security monitoring and response. The role combines hands-on engineering with disciplined validation, documentation, troubleshooting, and collaboration across analysts, threat hunters, intelligence personnel, platform engineers, and operational stakeholders.

Duties & Responsibilities

• Develop, test, maintain, and document custom analytics, detections, dashboards, scripts, interfaces, and automation playbooks.
• Tune sensors, rules, alerts, and analytics to improve fidelity, reduce false positives, and support efficient analyst workflows.
• Translate threat intelligence, hunt findings, incident lessons, and operational observations into improved detection content and response logic.
• Prototype and integrate approved technologies or custom capabilities needed to address monitoring, detection, response, or reporting gaps.
• Validate custom capabilities before operational use and document results, dependencies, limitations, configuration requirements, and maintenance considerations.
• Develop and maintain automation, orchestration, and response playbooks using approved tools and platforms.
• Diagnose and correct failed automation and workflows; safely restore or roll back affected functions and document corrective actions.
• Recommend targeted improvements to SOC tools, workflows, detections, dashboards, scripts, interfaces, and content.
• Support deployment, configuration, integration, and troubleshooting of security tools and sensors.
• Maintain version-controlled technical content, test cases, operating notes, and training materials for detections and automation.

Qualifications

Minimum Requirements:

• Three or more years of cybersecurity engineering, detection engineering, security analytics, or SOC automation experience.
• Experience developing or tuning security analytics in an enterprise SIEM or comparable monitoring platform.
• Experience scripting or integrating systems using Python, PowerShell, APIs, JSON, or comparable technologies.
• Experience testing security capabilities, documenting engineering work, and troubleshooting production issues.
• Ability to collaborate with analysts and stakeholders to translate operational needs into technical solutions.

Preferred Qualifications:

• Experience with Splunk SPL, Microsoft Sentinel KQL, Sigma, YARA, or comparable detection technologies.
• Experience developing playbooks in a SOAR or workflow-automation platform.
• Working knowledge of MITRE ATT&CK and practical detection-testing methods.
• Experience with cloud telemetry such as AWS CloudTrail, Azure Monitor, or Microsoft 365 audit logs.
• GCIA, GCDA, GCED, Splunk, Microsoft, CySA+, Security+, or comparable role-aligned certifications preferred.
• Experience supporting a 24x7 SOC where detection or automation failures have operational consequences.

What Success Looks Like

• Detection content is accurate, maintainable, testable, and tied to operational needs and observable data.
• Automation reduces manual effort without obscuring failure, creating unmanaged risk, or weakening analyst control.
• False positives, duplicate coverage, stale content, and broken workflows are identified and corrected promptly.
• Technical content and test evidence are sufficient for repeatable deployment, maintenance, and operational handoff.

Education and Certifications:

• Minimum: Bachelor's degree in cybersecurity, computer science, software engineering, information systems, or a related field; additional relevant experience may be considered in lieu of a degree

Clearance Level:

• Active Secret clearance required.

Work Location

• Hybrid federal customer environment. Onsite work may be required for integration, testing, deployment, or customer-directed activities.

Hours of Operation

• Core business hours with participation in after-hours support for automation, detection, and workflow failures as assigned.

• Ability to pass a minimum background investigation.