Detection Engineer

A detection engineer on the Cyber Incident Response Team of an information security organisation, working through Accenture Federal Services' IT Security group under the cybersecurity team lead. The engineer builds new detection logic in Microsoft Sentinel and for Cisco FirePower and IDS/IPS, writes and tunes KQL to cut false positives, keeps detections under version control in GitHub, maps coverage to MITRE ATT&CK, uses AI tooling where it helps, and works with network engineering to get the most out of security devices and push for secure designs.

The team wants US citizenship, six or more years in information security, hands-on Sentinel, KQL and FirePower experience, packet and malware analysis, and scripting; GCIA or GCED helps. Based in Arlington, VA.