Senior Detection Engineer

SAIC

. Develop, deploy, and maintain high-fidelity detections across SIEM, EDR, and other security telemetry platforms .

Posted 10/15/2026full-timeRemote • Tennessee • United StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in developing and optimizing detection logic across SIEM and EDR platforms, with a strong focus on incident response and threat analysis. Proficient in leveraging cybersecurity frameworks and mentoring teams to enhance operational effectiveness.

Highest-signal resume keywords

Splunk SIEM ExperienceCybersecurity OperationsDetection Logic DevelopmentCySA+ CertificationPython for Security Automation

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Detection Logic DevelopmentThreat AnalysisIncident ResponseSplunk SPL ProficiencySecurity Automation with PythonData EnrichmentTuning RecommendationsAdversary EmulationWorkflow DevelopmentTelemetry Analysis

Soft Skills

Leadership SkillsVerbal CommunicationWritten CommunicationMultitaskingCollaboration

Tools & Technologies

SIEMEDRSplunkCyber Threat IntelligenceESOC DashboardsAutomation ToolsDetection Content Onboarding

Certifications & Qualifications

CySA+SSCPSplunk Certified Cybersecurity Defense Engineer

Industry Keywords

CybersecurityDetection EngineeringOperational StandardsFalse Positive ReductionVisibility GapsPurple-Team OperationsIncident ReviewsSecurity Telemetry

Tech Stack

Tools & technologies

Cyber SecurityPythonSplunk

About the role

Key responsibilities & impact

Develop, deploy, and maintain high-fidelity detections across SIEM, EDR, and other security telemetry platforms
Validate alerts, refine workflows, and align detections with operational analyst needs
Provide detection-focused support during active incidents, including tuning recommendations, data enrichment, and technical guidance
Tune and optimize detections to improve fidelity, reduce false positives, strengthen efficiency, and close visibility gaps
Perform advanced threat and telemetry analysis to confirm detection performance and identify adversary behaviors
Translate cyber threat intelligence, TTPs, indicators, and behavioral patterns into actionable detections
Partner with CTI, Offensive Security Operations, and Purple-Team operators to validate detection logic through adversary emulation
Convert threat-hunting discoveries, vulnerability insights, and purple-team findings into improved detection logic and monitoring
Maintain documentation for detection logic, tuning actions, workflows, and operational standards
Mentor Detection Engineering analysts and support Detection & Response personnel development
Contribute to ESOC/DCO improvement initiatives, engineering sprints, automation, detection content onboarding, and process refinement
Lead post-incident detection reviews and improve detection coverage
Enhance ESOC dashboards, analytics, and tooling for monitoring, triage, and investigations
Support 24/7/365 operational coverage during high-priority events
Perform additional operational duties as assigned

Requirements

What you’ll need

Bachelor’s degree and 5+ years related experience, or a Master’s degree and 3+ years of related experience
An additional 4+ years of experience may be considered in lieu of a degree
Minimum of 3 years of cybersecurity operations experience working with the enterprise SIEM Splunk
Must possess CySA+, SSCP, or equivalent certification
Must obtain Splunk Certified Cybersecurity Defense Engineer certification within six months of hire
Advanced proficiency in Splunk SPL and Python for security automation and workflow development
Strong leadership skills with ability to lead and motivate a team effectively
Excellent verbal and written communication skills
Ability to multitask and collaborate to solve complex technical problems
Must support 24/7/365 operations when required

Benefits

Comp & perks

Remote work option for qualified candidates
4×10 schedule, Monday–Thursday, 07:00 a.m. EST–5:00 p.m. EST
Opportunity to mentor analysts and contribute to professional capability development