SIEM Content Developer (Ohio)

Responsibilities:
? Research and develop new threat-detection use cases based on emerging threats and cyber threat intelligence
? Develop SIEM detection content based on feedback from Incident Response and Threat Detection analysts
? Identify gaps in security monitoring, protection, and analytics capabilities
? Develop and maintain custom scripts to enhance SIEM functionality
? Review the quality and effectiveness of security data feeds
? Recommend and implement improvements to SIEM data ingestion and detection content
? Develop alerting priorities for critical systems and applications
? Create signatures and detection logic tailored to individual programs and applications
? Collaborate with cybersecurity tool SMEs, engineers, analysts, and mission stakeholders
? Analyze network architecture and log sources to develop appropriate detection strategies
? Map detection content and adversary behavior to MITRE ATT&CK
? Support Defense-in-Depth through improved enterprise detection capabilities

Qualifications:
? 5+ years of relevant IT experience
? 3+ years working with a SIEM in a content-development or Incident Response role
? 3+ years of System Administration and/or Network Administration experience
? Understanding of various log formats
? Understanding of the MITRE ATT&CK framework
? Strong understanding of network architecture
? Experience developing and maintaining scripts, preferably using PowerShell, Python, or SPL
? Understanding of Defense-in-Depth
? Current DoD Top Secret clearance
? Eligible for IT-I Critical Sensitive / Tier 5 (T5) at proposal submission