Cybersecurity Detection Engineer (Government)

A minimum of three years of experience working in detection engineering, threat hunting, security operations, or incident response using Splunk Enterprise Security or Microsoft Sentinel.

Experience with the processes to add/update/delete detection rules in Splunk Enterprise Security and Microsoft Sentinel.

Proficient in detection engineering methodologies including SNORT and YARA rules.

Proficient in Python programming, Bash, and PowerShell.

Proficient in Splunk's Search Processing Language, React, Kusto Query Language, and the Common Information Model (CIM)

Knowledgeable and experienced in leveraging cybersecurity threat intelligence, indicators of compromise, STIX/TAXII data feeds, MITRE ATT&CK, and SIEM integrations.

Strong experience in networking principles, operating systems (Linux / Windows), and security tools such as IDS/IPS, firewalls, proxy servers and Endpoint Detection and Response (EDR).

Knowledge of Windows Sysinternal Suite (including Sysmon) Unix auditd, and how to tune configuration files for identification of malicious activity.

At least one of the following certifications: Splunk Enterprise Security Certified Admin credential or have passed the AZ-500 Microsoft Azure Security Technologies exam.

Key Responsibilities:

• Develop and refine detection techniques to identify malicious activities and security breaches.

• Analyze descriptions of IOCs and design effective searches to detect these activities in large data sets.

• Create and maintain detection content, ensuring it is up-to-date with the latest threat intelligence.

• Collaborate with threat hunters to continuously improve detection capabilities.

• Utilize advanced Splunk query skills to develop and run complex searches and analyze security data.

• Ensure the accuracy and efficiency of detection mechanisms to reduce false positives and improve response times.

Required Clearance:

Able to pass police background check.

Required Qualifications:

• Proven experience as a Detection Engineer, with a strong emphasis on detection engineering as a primary job function.

• In-depth knowledge of threat hunting methodologies and experience working as a threat hunter.

• Expertise in Splunk, including the ability to create and optimize complex queries independently.

• Demonstrated ability to analyze and interpret various data sets to identify suspicious activities.

• Strong understanding of cyber security threats, vulnerabilities, and attack vectors.

• Ability to work independently and collaboratively within a team environment.

Desired Qualifications:

• Certifications related to cyber security and detection engineering (e.g., GIAC Certified Detection Analyst, Splunk Certified User).

• Experience in a Security Operations Center (SOC) environment, specifically in a detection engineering role.

• Familiarity with other security information and event management (SIEM) tools and technologies.

Note: This position is not an entry-level role. We require candidates with substantial experience in detection engineering, not just occasional detection creation as part of a SOC analyst role. Candidates who have primarily worked as SOC analysts and only occasionally created detections will not be considered suitable for this role. We are looking for individuals who have demonstrated a consistent focus on detection engineering throughout their career.

Our Cybersecurity Detection Engineer's earn between $89,200 - $207,900. Not to mention all the other amazing rewards that working at AT&T offers. Individual starting salary within this range may depend on geography, experience, expertise, and education/training.

Joining our team comes with amazing perks and benefits:

• Medical/Dental/Vision coverage

• 401(k) plan

• Tuition reimbursement program

• Paid Time Off and Holidays (based on date of hire, at least 23 days of vacation each year and 9 company-designated holidays)

• Paid Parental Leave

• Paid Caregiver Leave

• Additional sick leave beyond what state and local law require may be available but is unprotected

• Adoption Reimbursement

• Disability Benefits (short term and long term)

• Life and Accidental Death Insurance

• Supplemental benefit programs: critical illness/accident hospital indemnity/group legal

• Employee Assistance Programs (EAP)

• Extensive employee wellness programs

• Employee discounts up to 50% off on eligible AT&T mobility plans and accessories, AT&T internet (and fiber where available) and AT&T phone

Weekly Hours:

Time Type:

Regular

Location:

Oakton, Virginia

Salary Range:

$89,200.00 - $207,900.00

It is the policy of AT&T to provide equal employment opportunity (EEO) to all persons regardless of age, color, national origin, citizenship status, physical or mental disability, race, religion, creed, gender, sex, sexual orientation, gender identity and/or expression, genetic information, marital status, status with regard to public assistance, veteran status, or any other characteristic protected by federal, state or local law. In addition, AT&T will provide reasonable accommodations for qualified individuals with disabilities. AT&T is a fair chance employer and does not initiate a background check until an offer is made.

AT&T will consider for employment qualified applicants in a manner consistent with the requirements of federal, state and local laws

We expect employees to be honest, trustworthy, and operate with integrity. Discrimination and all unlawful harassment (including sexual harassment) in employment is not tolerated. We encourage success based on our individual merits and abilities without regard to race, color, religion, national origin, gender, sexual orientation, gender identity, age, disability, marital status, citizenship status, military status, protected veteran status or employment status