{"id":3180978,"url":"https://alion.io/job/dragonfli-group-detection-engineer-siemsoar","title":"Detection Engineer (SIEM/SOAR)","company":{"id":4430292,"name":"Dragonfli Group","domain":"dragonfligroup.com","url":"https://alion.io/company/dragonfli-group","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Comeet","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Washington, United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":116000,"max_usd":207000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":362},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Bash","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"FedRAMP","optional":true},{"name":"GCP","optional":true},{"name":"ISO 27001","optional":true},{"name":"Linux","optional":true},{"name":"Machine Learning","optional":true},{"name":"Unix","optional":true},{"name":"Windows","optional":true}],"status":"live","first_seen_at":"2026-10-23T21:10:26Z","employer_posted_date":"2026-10-23","last_verified_at":"2026-10-26T02:00:49Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Description\nDragonfli Group is a cybersecurity and IT consulting firm providing services to federal agencies and Fortune 100 enterprises. Headquartered in Washington, DC, Dragonfli supports clients in securing mission-critical systems across on-site, hybrid, and fully remote environments.\nWe are seeking a Cyber Threat Analyst to join the Detection and Automation Engineering (DAE) program within the security operations organization of a large federal agency. In this role you will design, implement, and maintain automated and AI-driven security detection and integration capabilities across enterprise security monitoring technologies. You will turn operational security needs into working detections and workflows, using SIEM, EDR, SOAR, and threat intelligence platforms (including Splunk Enterprise Security, Splunk SOAR, and SentinelOne), and Python, PowerShell, and Bash. You will work closely with SOC, threat intelligence, and incident response teams, and your documentation and operationalization discipline will keep detections reliable over time. The role calls for 8+ years of relevant cybersecurity experience in detection engineering, security operations, or a closely related field.\nThis is a multi-year contract position involving a large US federal agency. Candidates with previous federal contracting experience are preferred. U.S. Citizenship or Permanent Residency is required. If hired, all work related to this role must be performed within the continental U.S.\nResponsibilities\nDetection engineering and automation: build automation, AI-driven (\"Super Intelligence\"/SI), and integration workflows that improve detection and response.\nSecurity platform integration: integrate and optimize SIEM, EDR, SOAR, and threat intelligence technologies into a cohesive detection architecture.\nRequirements to implementation: analyze requirements and translate operational security needs into technical specifications and implementable solutions.\nTesting and validation: test, evaluate, and validate detections and automation workflows, and drive continuous improvement from results and operational feedback.\nSecurity data analysis: analyze telemetry to identify anomalies, trends, and detection gaps, then recommend and implement detection enhancements.\nDocumentation and sustainment: create and maintain technical documentation, SOPs, and runbooks that support reliable operations.\nCross-functional coordination: work with SOC, threat intelligence, and incident response teams to align detections to threat priorities and operational processes.\nEmerging capability evaluation: research and assess new security and AI/ML capabilities that enhance detection effectiveness.\nRequirements\nMust-Have\n3-8+ years of relevant cybersecurity experience in detection engineering, SOC operations, or security automation (inferred; see Recruiter Notes)\nBachelor's degree in a relevant field, or four additional years of relevant experience in lieu of a degree\nU.S. Citizenship or Permanent Residency, with all work performed within the continental U.S.\nCompTIA Security+ (or equivalent baseline certification)\nOne of: GCIA, GCIH, or CompTIA CySA+\nProgramming/scripting certification or demonstrated proficiency (Python, PowerShell, or similar)\nHands-on experience with SIEM and SOAR platforms, such as Splunk Enterprise Security, Splunk SOAR, SentinelOne, and SentinelOne Hyperautomation\nWorking knowledge of detection engineering methodologies, SOC operations, and incident response\nWorking knowledge of NIST SP 800-53, CIS Controls, and the MITRE ATT&CK framework\nExperience building and maintaining technical documentation, SOPs, and runbooks\nPreferred / Nice-to-Have\nCISSP or GIAC Security Essentials (GSEC)\nCompTIA SecAI+\nGMON or a similar continuous monitoring/detection-focused certification\nPrior federal contracting experience\nFamiliarity with NICE Framework, ISO 27001/27002, FISMA, FedRAMP, OMB circulars and federal cybersecurity directives, and the Privacy Act\nExperience with malware analysis, digital forensics procedures, and risk assessment methodologies\nExperience applying machine learning and AI to security detection\nSkill(s)\nTechnical Skills\nSIEM, EDR, and SOAR platforms: Splunk Enterprise Security, Splunk SOAR, SentinelOne, SentinelOne Hyperautomation\nDetection engineering methodologies and detection content development and tuning\nSecurity automation and orchestration concepts, including AI/ML-enabled security (\"Super Intelligence\"/SI)\nProgramming and scripting: Python, PowerShell, Bash\nAPI integration and development\nSOC operations and processes\nThreat intelligence lifecycle and analysis\nIncident response methodologies\nNetwork protocols and architecture\nOperating systems: Windows, Linux, Unix\nCloud platforms: AWS, Azure, GCP\nSecurity architecture and design\nSecurity telemetry and data analysis\nFrameworks and standards: NIST SP 800-53, CIS Controls, MITRE ATT&CK\nSoft Skills\nClear technical writing for documentation, SOPs, and runbooks\nCross-functional collaboration with SOC, threat intelligence, and incident response teams\nRequirements analysis and translating operational needs into technical specifications\nAnalytical, detail-oriented problem solving\nContinuous-improvement mindset driven by testing results and operational feedback\nCuriosity and initiative in evaluating emerging security and AI/ML capabilities\nBenefits\nMedical - Multiple POS health plan options including an HSA-compatible plan\nDental - PPO coverage for preventive, basic, and major services\nVision - Annual exam, frames, lenses, and contact lens allowance\n401(k) - Employer match up to 5% of eligible compensation\nLong-Term Disability - 100% employer-paid coverage at 50% of pre-disability earnings\nLife Insurance & AD&D - 100% employer-paid coverage valued at $10,000 each\nPTO - 15-25 days annually based on tenure\nPaid Federal Holidays - All 11 federal holidays observed","description_format":"text","description_chars":5888,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Life insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations"],"lifecycle":[{"event":"open","at":"2026-10-23T21:30:37Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":29,"reasons":["conf:2","velocity","win:early"],"computed_at":"2026-10-25T05:49:26Z"},"pay":null,"html_url":"https://alion.io/job/dragonfli-group-detection-engineer-siemsoar","json_url":"https://alion.io/job/dragonfli-group-detection-engineer-siemsoar.json","meta":{"generated_at":"2026-10-26T04:23:47Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6026,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4430292},"rest":"https://alion.io/mcp/rest/get_company?id=4430292"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fdragonfli-group-detection-engineer-siemsoar"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fdragonfli-group-detection-engineer-siemsoar"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fdragonfli-group-detection-engineer-siemsoar"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/dragonfli-group-detection-engineer-siemsoar\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fdragonfli-group-detection-engineer-siemsoar"}]}