Staff Cyber Security Detections Engineer

The Staff Cyber Security Detections Engineer at ManTech is responsible for a range of critical tasks, including formulating custom SIEM tool content, crafting IDS/IPS signatures to mitigate threats, and performing security event analysis. You’ll analyze the impact of cyber incidents, conduct trend reporting, and identify anomalous activities and threats to the organization’s resources.

To qualify for the Staff Cyber Security Detections Engineer role at ManTech, candidates must hold a bachelor’s degree or possess at least 4 years of relevant cyber experience. In addition, 2 years of cyber experience, familiarity with modern operating systems, and knowledge of enterprise security tools are key requirements. A DoD 8570 certification meeting IAT Level II is also necessary.

Essential technical skills for the Staff Cyber Security Detections Engineer role include experience with Windows, UNIX, network operating systems, and databases. Familiarity with SIEM and TIPs is crucial, as well as the ability to create and modify detection signatures and correlation searches effectively. Knowledge in countermeasures and mitigating controls is highly beneficial.

Yes, a current/active TS/SCI clearance with a Polygraph is mandatory for the Staff Cyber Security Detections Engineer position at ManTech. This clearance is vital as it ensures that you can work with sensitive information and maintain the security standards our clients expect.

A Staff Cyber Security Detections Engineer at ManTech can expect a collaborative and innovative work environment in Springfield, VA. The role demands both independent and teamwork capabilities, with frequent interactions among colleagues and opportunities to present findings and analyses. It's a space where creativity and critical thinking in cybersecurity are encouraged.

In crafting custom SIEM content, I start by researching the specific threats affecting our industry. I analyze relevant data sources and tailor the SIEM signatures to address those threats directly. Staying informed of evolving cyber threats ensures the content is not only relevant but also effective in real-time situations.

To conduct incident correlation, I first gather data from various sources within the organization. Then, I apply correlation techniques to identify patterns and anomalies that indicate potential security incidents. By analyzing these correlations, I can prioritize incidents to respond effectively.

After a security incident occurs, I conduct a thorough assessment by analyzing affected systems, data loss, and potential breaches. I compile information through logs and incident reports, which helps me quantify the impact and provide recommendations for remediation and future prevention.

I have extensive experience creating and tuning IDS/IPS signatures to minimize false positives and maximize threat detection efficacy. During this process, I analyze incident data to identify patterns and adjust thresholds in the signatures accordingly. Regular tuning ensures that our defenses remain robust against emerging threats.

For network traffic analysis, I recommend tools such as Wireshark for deep packet inspection and NetFlow analyzers for general traffic monitoring. Combining these tools with SIEM platforms allows for comprehensive visibility and helps in early threat detection.

I stay updated by following industry news, participating in cybersecurity forums, and attending conferences and webinars. Subscribing to threat intelligence feeds enhances my awareness of new vulnerabilities and tactics used by malicious actors, allowing me to adapt our defenses accordingly.

I’ve worked extensively with various SIEM tools for log management and threat detection. My experience includes configuring alerts, developing custom correlation rules, and generating reports to inform stakeholders about our security posture and incidents.

A Threat Intelligence Platform (TIP) aggregates threat data from multiple sources to help organizations prioritize risk and enhance their security frameworks. I utilize TIPs to correlate threat data with existing SIEM events, improving our response strategy to identified threats.

One of the biggest challenges I've faced is dealing with false positives that can dilute our response effectiveness. To overcome this, I developed more nuanced detection rules and engaged in regular communication with teams to refine our understanding of what constitutes an actual threat.

Analyzing network traffic is crucial for identifying anomalous behavior that could signify a security breach. By understanding normal traffic patterns, I can immediately detect irregularities, enabling swift intervention and minimizing potential damage to the organization.