Detection Engineer (Cloud)
Valiant Solutions, LLC2 years ago
Charleston, SC, USASenior
Responsibilities
- Design and implement detection logic for cloud-native threats and infrastructure across multi-cloud environments.
- Develop and optimize IDS/IPS signatures, log correlation rules, and other detection mechanisms.
- Analyze threat intelligence and indicator lifecycles to create and refine detections.
- Validate and test detection rules to improve accuracy and minimize false and benign positives.
- Perform Splunk and Elastic log analysis to support detection development and validation.
- Collaborate with DCO Watch Analysts to integrate detections into monitoring and incident response workflows.
- Maintain detection tools, signatures, and standard operating procedure documentation in accordance with CJCSM 6510.01B and other applicable directives.
- Coordinate with reporting agencies and subscriber sites and participate in program reviews, product evaluations, and certification evaluations.
- Support detection implementation or incident response surge activities, including overtime when required.
Requirements
- Active Secret clearance.
- Bachelor’s degree in a relevant discipline and five years of experience, or at least eight years of experience in a CSSP, SOC, or similar environment.
- At least five years of experience working in a cloud CSSP, SOC, or similar environment.
- At least two years of experience developing and optimizing signatures and detection logic across multiple platforms.
- DoD 8570 IAT Level II certification and a DoD 8140 CSSP-specific certification.
- Technical expertise in major cloud provider security models, services, and logs.
- Experience with Splunk, Elastic, threat intelligence platforms, and indicator management.
- Proficiency with detection creation and implementation processes and IDS/IPS signature development.
- Strong understanding of the indicator lifecycle and effective verbal and written communication skills.
- Preferred certifications include AWS Certified Security, Azure Security Engineer Associate, GCP Professional Cloud Security Engineer, or equivalent SANS GIAC certifications.
Benefits
- 100% onsite work in Charleston, South Carolina.
- Up to 10% travel may be required.
- Overtime may be required for detection implementation or incident response surge support.
- Equal opportunity employment and reasonable accommodations are provided.
Tech Stack
Categories