Cyber Detection Engineer

At Leidos, we deliver innovative solutions through the efforts of our diverse and talented people who are dedicated to our customer’s success. We empower our teams, contribute to our communities, and operate sustainably. Everything we do is built on a commitment to do the right thing for our customers, our people, and our community. Our Mission, Vision, and Values guide the way we do business.

The Cyber Detection Engineer will develop detections based on intelligence available, then research and assist in implementing new detection methods. This Detection Engineer will ensure that malicious activity will be detected within the environment. The DE is responsible for quality assurance of detections including filtering for potential false positives, mapping detections to MITRE ATT&CK framework, and specific campaigns/APTs when applicable. The Detection Engineer will work closely with other analysts to ensure detections are relevant to the current threat landscape. DE will work closely with the SIEM team to make recommendations for tuning and detection enhancements. The DE will evaluate the quality of data resulting from detections and ensure that the output of a detection leads to a meaningful investigation.

• Configure tools to detect atomic, computed or behavioral indicators based on generated tactical intelligence across SOC’s detection sensors such as Logging Infrastructure (SIEM, Connector/Forwarder, Data Stream Processing, etc.), Security Sensors (NIDS/NIPS, EDR, Email Protection, etc.), or SOAR.
• Develop and implement detection feedback processes - e.g., tuning false positives, etc.
• Ensure data quality meets completeness and consistency.
• Research new data source identification and configuration recommendations to facilitate detection of adversary activities.
• Use machine learning and pattern analysis to improve detection of specific types of threats.

Hiring of this position is dependent on the customer approving the candidate, and the candidate passing the agency security checking process prior to starting. The position will support core hours and have some flexibility to telework approximately 50% of the time, pending approval of the customer.

Required Qualifications:

• Requires BS degree and 8+ years of prior relevant experience in order to operate within the scope contemplated by the level; experience in lieu of degree may be acceptable.
• Prior experience performing as a SOC analyst
• Prior experience performing similar application security functions
• Working knowledge of SIEM solutions and incident management solutions
• Technical understanding of core cybersecurity technologies as well as emerging capabilities
• Strong analytical and troubleshooting skills
• Excellent written and verbal communication skills
• Team player
• CEH, GCIH, or relevant IT technology certification

Preferred Qualifications:

• Hands-on cybersecurity experience.
• Demonstrated understanding of the life cycle of cybersecurity threats, attacks, attack vector, and methods of exploitation with an understanding of intrusion set tactics, techniques and procedures (TTPs).
• Familiarity or experience in Intelligence Driven Defense, Cyber Kill Chain methodology, and/or MITRE ATT&CK framework.
• Familiarity with the NOAA mission.

Clearance:

• US Citizenship is required.
• Must be able to maintain security clearance, specifically DoD/Top Secret Clearance (Interim Top Secret or adjudicated Secret acceptable).

Location:

• Fairmont, WV