Detection and Response Engineer (SPLUNK)

Detection and Response Engineer on Coalfire's Defensive Services team, which provides SIEM alert monitoring, threat hunting and purple teaming to clients with federal compliance and commercial security needs. The role is remote within the US.

The engineer turns threat intelligence into detections, writes and tunes detection and hunting queries across at least two SIEM platforms, builds dashboards, runs hypothesis-led hunts, investigates alerts across log sources, and escalates confirmed incidents with evidence and MITRE ATT&CK mapping. Coalfire wants two to four years in large enterprise security environments, working knowledge of a major cloud platform, production experience with Splunk, Sentinel, ELK or similar, and at least one SIEM administrator certification such as Splunk Enterprise Certified Administrator. Detection-as-code and NIST 800-53 experience help.