Senior Detection Engineer (Cybersecurity)

Location: Onsite in Arlington, VA, United States of America

Salary: $122,000–$253,000 per year, commensurate with qualifications, experience, and expertise.

Company

hirify.global provides cyber operations, data operations, systems integration, intelligence mission support, vulnerability research, cyber defense, technical surveillance, data intelligence, mission enablement, and software modernization services for intelligence, defense, civil, and commercial customers.

What you will do

• Develop, validate, deploy, and tune behavioral analytics, correlation rules, signatures, investigative queries, and automation across endpoint, network, identity, cloud, and application telemetry.
• Conduct threat-hunting investigations into persistence, privilege escalation, credential access, lateral movement, command and control, and defense evasion, correlating evidence across data sources.
• Convert hunt findings, incident-response lessons, and exercise results into reusable, documented detections with defined data requirements, validation evidence, limitations, acceptance criteria, and rollback procedures.
• Test detections using historical telemetry, controlled simulations, purple-team exercises, and representative malicious and benign activity; analyze false positives, false negatives, alert volume, thresholds, exclusions, and environmental baselines.
• Assess sensor, tool, and data-source quality; identify collection, parsing, normalization, retention, and pipeline gaps; and coordinate remediation with infrastructure and delivery teams.
• Coordinate with threat hunters, incident responders, intelligence analysts, platform engineers, analytics developers, and data scientists; provide technical leadership, mentor analysts, and maintain detection engineering standards, training scenarios, JQRs, and practical assessments.

Requirements

• Must be a US citizen and hold an active TS/SCI clearance; must be able to obtain DHS Suitability.
• 10+ years of directly relevant experience, including senior-level experience in threat hunting, detection engineering, incident response, or closely related defensive cyber operations, with independent ownership of production detection content.
• Strong command of hypothesis development, adversary behavior analysis, iterative investigation, and evidence-based conclusions.
• Ability to develop, test, deploy, tune, and document production detections, explain their limitations, and assess the effects of exclusions and suppression.
• Advanced proficiency in one or more security query languages, including KQL, SPL, EQL, ES|QL, or vendor-specific EDR languages, with the ability to optimize logic across platforms.
• Experience analyzing process execution, command lines, process ancestry, authentication, persistence mechanisms, network connections, and enterprise telemetry.
• Understanding of Windows and Linux internals, enterprise networking, identity systems, cloud telemetry, and sophisticated adversary tradecraft.
• Practical experience mapping detections to MITRE ATT&CK and explaining telemetry, test evidence, and limitations behind coverage claims.
• Proficiency in Python and PowerShell, or comparable languages, for analysis, enrichment, testing, and automation; plus experience translating operational findings into engineering requirements and acceptance criteria.
• Bachelor’s degree in Engineering, Computer Science, Cybersecurity, Information Systems, or a related field.

Nice to have

• Master’s degree in a related field.
• Experience with CrowdStrike Falcon, Microsoft Defender, Cortex XDR, SentinelOne, Elastic, Splunk, or comparable platforms.
• Experience with portable detection content such as Sigma, detection-as-code, automated testing, SIEM data onboarding, and pipeline tuning.
• Experience with adversary emulation, cyber exercise development, federal civilian or critical-infrastructure cyber operations, and maintaining detection engineering competencies, JQRs, training scenarios, and practical assessments.
• Certifications including GCDA, GCFA, GDAT, GCIA, GCIH, GCTI, Microsoft SC-200, or CISSP.

Culture & Benefits

• Onsite work supporting a U.S. Government customer and civilian government agencies and critical asset owners.
• Medical, vision, and dental insurance coverage.
• 401(k) plan, paid time off, holidays, and additional insurance programs.
• Equal opportunity and affirmative action employment practices.