Cyber Threat Analyst-Detection Engineer

Cyber-Threat Analyst                                                           

Task description and/or any specific requirements:                                             

DAE Detection Integration/Automation/Super Intelligence (SI) Contractor, Roles, Responsibilities & Qualifications

Core Roles & Responsibilities

•       Detection Engineering & Automation/SI: Build automation/SI and integration workflows to improve detection and response.

•       Security platform integration: Integrate and optimize security technologies (e.g., SIEM, EDR, SOAR, threat intelligence) into a cohesive detection architecture.

•       Requirements-to-implementation: Perform requirements analysis and translate operational security needs into technical specifications and implementable solutions.

•       Testing & validation: Execute testing, evaluation, and validation of detections and automation/SI workflows; drive continuous improvements based on results and operational feedback.

•       Security data analysis: Analyze telemetry to identify anomalies, trends, and detection gaps; recommend and implement detection enhancements.

•       Documentation & sustainment: Create and maintain technical documentation, SOPs, and runbooks to support reliable operations.

•       Cross-functional coordination: Work closely with SOC, threat intelligence, and incident response teams to align detections to threat priorities and operational processes.

•       Emerging capability evaluation: Research and assess new security and SI/ML capabilities to enhance detection effectiveness.

Essential Technical Knowledge Areas (plus important/beneficial)

•       SOAR Tools: SentinelOne, SentinelOne Hyperautomation, Splunk Enterprise Security, Splunk SOAR

•       Super Intelligence (SI) Security

•       SOC operations and processes

•       Threat intelligence lifecycle and analysis

•       Incident response methodologies

•       Network protocols and architecture

•       Operating systems (Windows/Linux/Unix)

•       Cloud platforms (AWS/Azure/Google Cloud Platform)

•       Security architecture and design

•       Programming/scripting (Python, PowerShell, Bash)

•       API integration and development

•       Detection engineering methodologies

•       Security automation and orchestration concepts

Frameworks, Standards & Compliance Expectations

•       NIST SP 800-53 Security Controls

•       CIS Controls

•       MITRE ATT&CK Framework

Important/beneficial

•       CISA NICE Framework

•       ISO 27001/27002

•       FISMA

•       FedRAMP

•       OMB Circulars and Federal Cybersecurity Directives

•       Privacy Act

Important / Beneficial

•       Malware analysis

•       Digital forensics procedures

•       Risk assessment methodologies

•       Machine learning and SI for security

Certification Requirements

•       CompTIA Security+ (or equivalent baseline)

•       One of: GCIA, GCIH, or CompTIA CySA+

•       Programming/scripting certification or demonstrated proficiency (e.g., Python, PowerShell, similar)

Preferred

•       CISSP or GIAC Security Essentials (GSEC)

•       Comptia SecAI+

•       GMON (or similar continuous monitoring/detection-focused certification)