Senior Detection Engineer

SAIC has an opening for a Senior Detection Engineer. This position is located in Oak Ridge, Tennessee; however, SAIC is open to remote work for qualified candidates.

This role serves as a Senior Technical Analyst within SAIC’s Enterprise Security Operations Center (ESOC) and Detection Engineering Team. Reporting to the Manager of Defensive Cyber Operations (DCO), the Senior Analyst is responsible for enhancing enterprise-wide threat detection capabilities. The Senior Analyst develops high-fidelity detections on an operational cadence across SIEM, EDR, and other security telemetry platforms, ensuring SAIC maintains strong visibility into adversary tactics and emerging threats. In this position, the analyst works closely with the 24/7 Detection and Response, Cyber Incident Response, Cyber Threat Intelligence, Offensive Security Operations, and Sustainment teams to operationalize detections and continuously strengthen the organization’s defensive posture.

In addition to advanced threat analysis and detection engineering responsibilities, the Senior Analyst mentors Detection Engineering analysts and collaborates across teams to support capability development, detection tuning, and documentation improvements. This includes contributing to continuous improvement initiatives and participating in cross-team knowledge-sharing activities that align with broader ESOC and DCO operational objectives.

The position will work a 4×10 schedule, 07:00 a.m. EST - 5:00 p.m. EST, Monday-Thursday, with the expectation to support 24/7/365 operations when required.

Job Duties:

• Operationally develop, deploy, and maintain high-fidelity detections across SIEM, EDR, and other security telemetry platforms to support continuous monitoring and response.
• Work closely with the Detection & Response team to validate alerts, refine workflows, and ensure engineered detections align with operational needs and real-world analyst workflows.
• Provide rapid detection-focused support during active incidents, including tuning recommendations, data enrichment, and technical guidance for investigation teams.
• Conduct ongoing tuning and optimization to improve detection fidelity, reduce false positives, strengthen efficiency, and close visibility gaps across the enterprise.
• Perform advanced threat and telemetry analysis to confirm detection performance, identify adversary behaviors, and ensure coverage of emerging threats.
• Operationalize Cyber Threat Intelligence (CTI) by translating observed TTPs, indicators, and behavioral patterns into reliable, actionable detections aligned with DCO mission requirements.
• Partner with CTI, Offensive Security Operations (OSO), and Purple-Team operators to validate detection logic through adversary emulation, exercise detection coverage, and refine monitoring gaps identified during testing.
• Convert threat-hunting discoveries, vulnerability insights, and purple-team findings into improved detection logic, analytics, and monitoring enhancements.
• Maintain clear documentation for detection logic, tuning actions, workflows, and operational standards to support consistency and repeatability across the SOC.
• Mentor Detection Engineering analysts and support development of Detection & Response personnel to strengthen operational capability and readiness.
• Contribute to ESOC/DCO improvement initiatives, including engineering sprints, automation efforts, detection content onboarding, and process refinement.
• Lead post-incident detection reviews to identify root-cause gaps, update detection coverage, and improve overall defensive posture.
• Enhance dashboards, analytics, and tooling used across ESOC to support monitoring, triage, and investigative operations.
• Support the ESOCs 24/7/365 operational needs as required to maintain continuity of coverage during high-priority or elevated-tempo events.
• Perform additional duties and support other operational tasks as assigned to meet mission and organizational needs.

Education and Experience Requirements:

• Bachelor’s degree and 5+ years related experience, or a Master’s degree and 3+ years of related experience. An additional 4+ years of experience may be considered in lieu of a degree.
• Must have a minimum of 3 years of cybersecurity operations experience working with the enterprise SIEM Splunk.
• Must possess one of the following certifications: CySA+, SSCP, or equivalent
• Must obtain the following certification within six (6) months of hire: Splunk Certified Cybersecurity Defense Engineer.

Required Skills:

• Advanced proficiency in Splunk SPL and Python for security automation and workflow development.
• Strong leadership skills with a proven ability to lead and motivate a team effectively.
• Can-do attitude.
• Self-motivated and quick learner.
• Excellent verbal and written communication skills.
• Ability to multitask and collaborate to solve complex technical problems.

Desirables:

• One or more of the following certifications: ISC2 - CISSP, Splunk Certified Cybersecurity Defense Analyst, Splunk Certified Cybersecurity Defense Engineer.