Senior Detection Engineer (Cybersecurity)

Location: Onsite in Arlington, VA, United States

Company

hirify.global is a small business providing IT, cybersecurity, information assurance, SOA, big data management, and program management solutions to federal, state, and local agencies.

What you will do

• Develop hypotheses and conduct investigations into persistence, privilege escalation, credential access, lateral movement, command and control, and defense evasion.
• Build, validate, deploy, and tune behavioral analytics, correlation rules, signatures, and queries across endpoint, network, identity, cloud, and application telemetry.
• Convert threat hunts, incident findings, and exercises into reusable detections with documented requirements, validation evidence, limitations, and rollback procedures.
• Analyze detection fidelity, false positives and negatives, alert thresholds, environmental baselines, sensor quality, and data collection gaps.
• Develop automation for enrichment, query execution, detection validation, analytical workflows, and SOAR playbooks; tune data pipelines and queries.
• Coordinate with hunters, responders, intelligence analysts, platform engineers, analytics developers, and data scientists while mentoring analysts and setting detection engineering standards.

Requirements

• Must be a U.S. citizen, hold an active TS/SCI clearance, and be able to obtain DHS Suitability.
• 10+ years of directly relevant experience, including senior-level threat hunting, detection engineering, incident response, or closely related defensive cyber operations and independent ownership of production detection content.
• Strong command of hypothesis development, adversary behavior analysis, iterative investigation, and evidence-based conclusions.
• Proven ability to develop, test, deploy, and tune production detections, explain limitations, and assess exclusions and suppression effects.
• Advanced proficiency in one or more security query languages: KQL, SPL, EQL, ES|QL, or vendor-specific EDR languages.
• Experience analyzing process execution, command lines, process ancestry, authentication, persistence, network connections, and enterprise telemetry.
• Understanding of Windows and Linux internals, enterprise networking, identity systems, cloud telemetry, and sophisticated adversary tradecraft.
• Experience mapping detections to MITRE ATT&CK and explaining telemetry, test evidence, and coverage limitations.
• Proficiency in Python and PowerShell, or comparable languages, for analysis, enrichment, testing, and automation.
• Bachelor’s degree in Engineering, Computer Science, Cybersecurity, Information Systems, or a related field.
• Ability to document detection intent, logic, validation, investigation steps, tuning decisions, engineering requirements, and acceptance criteria.

Nice to have

• Experience with CrowdStrike Falcon, Microsoft Defender, Cortex XDR, SentinelOne, Elastic, Splunk, or comparable platforms.
• Experience with Sigma, detection-as-code, automated testing, SIEM data onboarding, and pipeline tuning.
• Experience with adversary emulation, cyber exercise development, and federal civilian or critical infrastructure cyber operations.
• Master’s degree in a relevant field.
• GIAC, Microsoft SC-200, CISSP, or related cybersecurity certifications, including GCDA, GCFA, GDAT, GCIA, GCIH, and GCTI.

Culture & Benefits

• Onsite work supporting U.S. Government and critical infrastructure cyber operations.
• 95% employer-paid employee medical, dental, and vision coverage.
• Employer-paid life, short-term disability, and long-term disability coverage.
• 401(k) with company match and flexible spending accounts for dependent and healthcare expenses.
• 11 standard holidays and three weeks of annual leave.