SIEM Content Developer (Ohio) Markesman Group - 5.0 Whitehall, OH Job Details Full-time 2 hours ago Qualifications Security Event Management (security operations) Log analysis tools Network architecture

MITRE ATT&CK

Full Job Description Responsibilities:

? Research and develop new threat-detection use cases based on emerging threats and cyber threat intelligence ? Develop SIEM detection content based on feedback from Incident Response and Threat Detection analysts ? Identify gaps in security monitoring, protection, and analytics capabilities ? Develop and maintain custom scripts to enhance SIEM functionality ? Review the quality and effectiveness of security data feeds ? Recommend and implement improvements to SIEM data ingestion and detection content ? Develop alerting priorities for critical systems and applications ? Create signatures and detection logic tailored to individual programs and applications ? Collaborate with cybersecurity tool SMEs, engineers, analysts, and mission stakeholders ? Analyze network architecture and log sources to develop appropriate detection strategies ? Map detection content and adversary behavior to

MITRE ATT&CK

? Support Defense-in-Depth through improved enterprise detection capabilities

Qualifications:

? 5+ years of relevant IT experience ? 3+ years working with a SIEM in a content-development or Incident Response role ? 3+ years of System Administration and/or Network Administration experience ? Understanding of various log formats ? Understanding of the

MITRE ATT&CK

framework ? Strong understanding of network architecture ? Experience developing and maintaining scripts, preferably using PowerShell, Python, or SPL ? Understanding of Defense-in-Depth ? Current DoD Top Secret clearance ? Eligible for IT-I Critical Sensitive / Tier 5 (T5) at proposal submission