Detection Engineer (SIEM/SOAR)

Location: Remote (US)

Experience Level: Intermediate

Description

Dragonfli Group is a cybersecurity and IT consulting firm providing services to federal agencies and Fortune 100 enterprises. Headquartered in Washington, DC, Dragonfli supports clients in securing mission-critical systems across on-site, hybrid, and fully remote environments.

We are seeking a Cyber Threat Analyst to join the Detection and Automation Engineering (DAE) program within the security operations organization of a large federal agency. In this role you will design, implement, and maintain automated and AI-driven security detection and integration capabilities across enterprise security monitoring technologies. You will turn operational security needs into working detections and workflows, using SIEM, EDR, SOAR, and threat intelligence platforms (including Splunk Enterprise Security, Splunk SOAR, and SentinelOne), and Python, PowerShell, and Bash. You will work closely with SOC, threat intelligence, and incident response teams, and your documentation and operationalization discipline will keep detections reliable over time. The role calls for 8+ years of relevant cybersecurity experience in detection engineering, security operations, or a closely related field.

This is a multi-year contract position involving a large US federal agency. Candidates with previous federal contracting experience are preferred. U.S. Citizenship or Permanent Residency is required. If hired, all work related to this role must be performed within the continental U.S.

Responsibilities

• Detection engineering and automation: build automation, AI-driven ("Super Intelligence"/SI), and integration workflows that improve detection and response.
• Security platform integration: integrate and optimize SIEM, EDR, SOAR, and threat intelligence technologies into a cohesive detection architecture.
• Requirements to implementation: analyze requirements and translate operational security needs into technical specifications and implementable solutions.
• Testing and validation: test, evaluate, and validate detections and automation workflows, and drive continuous improvement from results and operational feedback.
• Security data analysis: analyze telemetry to identify anomalies, trends, and detection gaps, then recommend and implement detection enhancements.
• Documentation and sustainment: create and maintain technical documentation, SOPs, and runbooks that support reliable operations.
• Cross-functional coordination: work with SOC, threat intelligence, and incident response teams to align detections to threat priorities and operational processes.
• Emerging capability evaluation: research and assess new security and AI/ML capabilities that enhance detection effectiveness.

Requirements

Must-Have

• 3-8+ years of relevant cybersecurity experience in detection engineering, SOC operations, or security automation (inferred; see Recruiter Notes)
• Bachelor's degree in a relevant field, or four additional years of relevant experience in lieu of a degree
• U.S. Citizenship or Permanent Residency, with all work performed within the continental U.S.
• CompTIA Security+ (or equivalent baseline certification)
• One of: GCIA, GCIH, or CompTIA CySA+
• Programming/scripting certification or demonstrated proficiency (Python, PowerShell, or similar)
• Hands-on experience with SIEM and SOAR platforms, such as Splunk Enterprise Security, Splunk SOAR, SentinelOne, and SentinelOne Hyperautomation
• Working knowledge of detection engineering methodologies, SOC operations, and incident response
• Working knowledge of NIST SP 800-53, CIS Controls, and the MITRE ATT&CK framework
• Experience building and maintaining technical documentation, SOPs, and runbooks

Preferred / Nice-to-Have

• CISSP or GIAC Security Essentials (GSEC)
• CompTIA SecAI+
• GMON or a similar continuous monitoring/detection-focused certification
• Prior federal contracting experience
• Familiarity with NICE Framework, ISO 27001/27002, FISMA, FedRAMP, OMB circulars and federal cybersecurity directives, and the Privacy Act
• Experience with malware analysis, digital forensics procedures, and risk assessment methodologies
• Experience applying machine learning and AI to security detection

Skill(s)

Technical Skills

• SIEM, EDR, and SOAR platforms: Splunk Enterprise Security, Splunk SOAR, SentinelOne, SentinelOne Hyperautomation
• Detection engineering methodologies and detection content development and tuning
• Security automation and orchestration concepts, including AI/ML-enabled security ("Super Intelligence"/SI)
• Programming and scripting: Python, PowerShell, Bash
• API integration and development
• SOC operations and processes
• Threat intelligence lifecycle and analysis
• Incident response methodologies
• Network protocols and architecture
• Operating systems: Windows, Linux, Unix
• Cloud platforms: AWS, Azure, GCP
• Security architecture and design
• Security telemetry and data analysis
• Frameworks and standards: NIST SP 800-53, CIS Controls, MITRE ATT&CK

Soft Skills

• Clear technical writing for documentation, SOPs, and runbooks
• Cross-functional collaboration with SOC, threat intelligence, and incident response teams
• Requirements analysis and translating operational needs into technical specifications
• Analytical, detail-oriented problem solving
• Continuous-improvement mindset driven by testing results and operational feedback
• Curiosity and initiative in evaluating emerging security and AI/ML capabilities

Benefits

Medical — Multiple POS health plan options including an HSA-compatible plan

Dental — PPO coverage for preventive, basic, and major services

Vision — Annual exam, frames, lenses, and contact lens allowance

401(k) — Employer match up to 5% of eligible compensation

Long-Term Disability — 100% employer-paid coverage at 50% of pre-disability earnings

Life Insurance & AD&D — 100% employer-paid coverage valued at $10,000 each

PTO — 15–25 days annually based on tenure

Paid Federal Holidays — All 11 federal holidays observed

Travel