Cyber Detection Engineer Subject Matter Expert

Job Description

Job Description:\n\nCyber Detection Engineer Subject Matter Expert (SME)\nArgo Cyber Systems, LLC | Federal Cybersecurity Operations\nSecurity Clearance: Active Top Secret / SCI (TS/SCI) RequiredCitizenship: U.S. Citizenship RequiredSuitability: Must be able to obtain DHS SuitabilityExperience Level: Senior / Subject Matter ExpertWork Location: Arlingotn VAPosition Overview\nArgo Cyber Systems is seeking a highly skilled Cyber Detection Engineer Subject Matter Expert (SME) to support a mission-critical U.S. Government cybersecurity program focused on defending federal civilian agencies and critical infrastructure against advanced cyber threats.\nIn this role, you will lead the development, validation, deployment, and optimization of advanced cybersecurity detection capabilities supporting proactive threat hunting, incident response, and enterprise security operations.\nThe ideal candidate combines extensive threat hunting experience, sophisticated adversary behavior analysis, and hands-on detection engineering expertise. You will transform threat intelligence, investigative findings, and incident response lessons into scalable behavioral analytics, reliable detection logic, and automated defensive capabilities.\nWorking across endpoint, network, identity, cloud, and application environments, you will help identify sophisticated threats, eliminate security visibility gaps, and continuously improve detection effectiveness.\nThis position offers an opportunity to directly strengthen the nation's cyber defenses by engineering advanced detection capabilities that identify malicious activity before it can significantly impact federal systems and critical infrastructure.Key ResponsibilitiesAdvanced Threat Hunting and Detection Engineering\n\n \n Develop and execute hypothesis-driven threat hunting methodologies to identify advanced adversary activity, including persistence, privilege escalation, credential access, lateral movement, command and control, and defense evasion.\n \n Design, develop, test, and deploy advanced behavioral analytics, correlation rules, detection signatures, and investigative queries.\n \n Develop detection logic using endpoint, network, identity, cloud, and application telemetry.\n \n Focus detection strategies on adversary tactics, techniques, and procedures (TTPs) rather than relying exclusively on indicators of compromise.\n \n Correlate evidence across multiple security data sources to identify suspicious activity and produce defensible investigative conclusions.\n \n Translate threat intelligence, hunt findings, incident response lessons, and cyber exercise results into reusable detection capabilities.\n \n Map detection content to MITRE ATT&CK techniques and document the evidence supporting detection coverage.\nDetection Validation, Optimization, and Quality Assurance\n\n \n Validate detection logic against representative malicious and benign activity using historical telemetry, controlled simulations, and purple team exercises.\n \n Analyze false positives, false negatives, alert volume, detection thresholds, and environmental baselines.\n \n Optimize detection fidelity while minimizing unnecessary analyst workload and preserving visibility into legitimate threats.\n \n Evaluate detection evasion opportunities and assess the operational impact of exclusions, suppression rules, and tuning decisions.\n \n Develop and maintain detection documentation, including analytical intent, required data sources, investigation procedures, assumptions, validation results, and known limitations.\n \n Establish and maintain peer-review procedures, version control, deployment standards, release approvals, and rollback processes.\n \n Revalidate detection content following platform updates, schema changes, environmental modifications, and evolving adversary techniques.\nSecurity Telemetry and Engineering Integration\n\n \n Assess the availability, reliability, and quality of enterprise security telemetry and monitoring capabilities.\n \n Identify gaps in sensor coverage, log collection, parsing, normalization, retention, and data accessibility.\n \n Coordinate with infrastructure engineers, platform administrators, and technical delivery teams to resolve visibility and collection deficiencies.\n \n Translate operational threat hunting and detection gaps into actionable engineering requirements and measurable acceptance criteria.\n \n Validate implemented improvements to ensure security capabilities meet operational requirements.\n \n Evaluate emerging security technologies, data sources, and analytical techniques against identified mission needs.\nSecurity Automation and Advanced Analytics\n\n \n Develop and maintain automation supporting threat detection, data enrichment, query execution, investigation workflows, and detection validation.\n \n Build or enhance Security Orchestration, Automation, and Response (SOAR) playbooks where applicable.\n \n Optimize analytical queries and security data pipelines to improve performance, scalability, and responsiveness.\n \n Implement appropriate review mechanisms, error handling, and recovery procedures within automated workflows.\n \n Collaborate with analytics developers and data scientists to evaluate advanced analytical methods, including machine learning where operationally appropriate.\n \n Assess analytical effectiveness, false-positive rates, data dependencies, and technical limitations before recommending production adoption.\nTechnical Leadership and Mission Support\n\n \n Serve as a senior technical advisor supporting threat hunting, detection engineering, vulnerability management, and defensive cyber operations.\n \n Collaborate with threat hunters, incident responders, cyber threat intelligence analysts, and platform engineering teams.\n \n Develop cyber exercise scenarios and define expected detection outcomes to evaluate defensive capabilities.\n \n Assess sensing failures, identify operational risks, and coordinate corrective actions.\n \n Review analytical work products and mentor cybersecurity analysts and engineers.\n \n Establish technical standards for detection development, documentation, testing, deployment, and optimization.\n \n Support development of detection engineering competencies, Job Qualification Requirements (JQRs), training scenarios, and practical assessments.\n \n Communicate detection effectiveness, validated coverage, operational risks, and remaining security gaps to technical leadership and government stakeholders.\nRequired QualificationsSecurity and Eligibility\n\n \n U.S. Citizenship is required.\n \n Active Top Secret / Sensitive Compartmented Information (TS/SCI) security clearance is required.\n \n Must be able to obtain DHS Suitability.\nProfessional Experience\n\n \n Minimum 10 years of directly relevant professional experience.\n \n Demonstrated senior-level experience in threat hunting, detection engineering, incident response, or closely related defensive cybersecurity operations.\n \n Proven experience independently developing, deploying, and maintaining production detection content.\n \n Demonstrated ability to translate operational threat intelligence and investigative findings into effective security detection capabilities.\n \n Experience coordinating security engineering improvements across multidisciplinary technical teams.\nTechnical Expertise\n\n \n Advanced knowledge of hypothesis-driven threat hunting, adversary behavior analysis, and evidence-based cybersecurity investigations.\n \n Proven ability to design, test, deploy, optimize, and maintain production detection rules and behavioral analytics.\n \n Advanced proficiency in one or more security query languages, including:\n \n \n Splunk Search Processing Language (SPL)\n \n Kusto Query Language (KQL)\n \n Elasticsearch Query Language (EQL)\n \n Elasticsearch ES|QL\n \n Vendor-specific endpoint detection and response query languages\n \n \n Strong understanding of Windows and Linux operating system internals, enterprise networking, identity management, and cloud security telemetry.\n \n Experience analyzing process execution, command-line activity, process ancestry, authentication events, persistence mechanisms, and network connections.\n \n Practical experience applying MITRE ATT&CK to detection engineering, adversary behavior analysis, and security coverage assessments.\n \n Ability to evaluate detection fidelity, false positives, false negatives, exclusions, and suppression risks.\n \n Proficiency with Python, PowerShell, or comparable scripting languages for security analytics, automation, testing, and enrichment.\n \n Experience identifying telemetry gaps and translating operational needs into technical requirements and acceptance criteria.\n \n Strong technical writing skills, including documenting detection logic, validation procedures, investigative guidance, and tuning decisions.\nPreferred Qualifications\nCandidates with experience in the following technologies and operational environments are especially encouraged to apply:\nSecurity Platforms and Technologies\n\n \n CrowdStrike Falcon\n \n Microsoft Defender\n \n Palo Alto Cortex XDR\n \n SentinelOne\n \n Splunk\n \n Elastic Security\n \n Comparable enterprise SIEM and EDR platforms\n\nAdvanced Detection Engineering\n\n \n Experience developing portable detection content using Sigma.\n \n Familiarity with detection-as-code methodologies, version-controlled detection repositories, and automated validation.\n \n Experience with SIEM data onboarding, security telemetry normalization, and pipeline optimization.\n \n Experience designing and executing adversary emulation, purple team exercises, and cyber defense validation scenarios.\n \n Knowledge of advanced behavioral analytics and automated detection workflows.\n\nFederal Cybersecurity Operations\n\n \n Experience supporting federal civilian cybersecurity programs or critical infrastructure environments.\n \n Familiarity with government incident response, threat hunting, and enterprise defensive cyber operations.\n \n Experience developing detection engineering training programs, JQRs, practical assessments, and technical competency standards.\n \n Demonstrated ability to work with government stakeholders and multidisciplinary cybersecurity teams.\nEducation Requirements\nRequired: Bachelor's degree in Engineering, Computer Science, Cybersecurity, Information Systems, or a related technical field.\nPreferred: Master's degree in a relevant technical discipline.Desired Professional Certifications\nOne or more of the following certifications is preferred:\n\n \n GIAC Certified Detection Analyst (GCDA)\n \n GIAC Certified Forensic Analyst (GCFA)\n \n GIAC Defending Advanced Threats (GDAT)\n \n GIAC Certified Intrusion Analyst (GCIA)\n \n GIAC Certified Incident Handler (GCIH)\n \n GIAC Cyber Threat Intelligence (GCTI)\n \n Microsoft Certified: Security Operations Analyst Associate (SC-200)\n \n Certified Information Systems Security Professional (CISSP)\nWhy Join Argo Cyber Systems?\nAt Argo Cyber Systems, our cybersecurity professionals support critical missions that protect federal agencies, government systems, and the nation's essential infrastructure.\nAs an SBA-certified Service-Disabled Veteran-Owned Small Business (SDVOSB), Argo Cyber Systems delivers specialized cybersecurity expertise supporting some of the most demanding defensive cyber operations.\nJoining our team provides an opportunity to:\n\n \n Support National Cybersecurity Missions: Contribute directly to defending federal civilian agencies and critical infrastructure against sophisticated cyber threats.\n \n Engineer Advanced Detection Capabilities: Develop and implement security analytics that improve adversary detection and operational response.\n \n Work with Advanced Cybersecurity Technologies: Apply modern SIEM, EDR, automation, threat hunting, and security analytics technologies.\n \n Collaborate with Experienced Cyber Professionals: Work alongside skilled threat hunters, incident responders, intelligence analysts, and security engineers.\n \n Drive Technical Innovation: Help transform threat hunting discoveries into repeatable, scalable, and operationally effective defensive capabilities.\n \n Make a Measurable Impact: Improve detection coverage, reduce visibility gaps, and strengthen the security posture of mission-critical government environments.\n\nArgo Cyber Systems values technical excellence, professional integrity, collaboration, and a commitment to protecting our nation's cybersecurity infrastructure.Apply Today\nIf you are an experienced cybersecurity professional with deep expertise in threat hunting, advanced detection engineering, and adversary behavior analysis, we encourage you to explore this opportunity with Argo Cyber Systems.\nJoin a mission-focused team working to develop the next generation of cybersecurity detection capabilities supporting the U.S. Government.\nPosition: Cyber Detection Engineer Subject Matter Expert (SME)Company: Argo Cyber Systems, LLCSecurity Clearance: Active TS/SCI RequiredCitizenship: U.S. Citizenship RequiredSuitability: Must be able to obtain DHS Suitability\nArgo Cyber Systems is an Equal Opportunity Employer. Employment decisions are made without regard to legally protected characteristics, consistent with applicable federal, state, and local laws.\nBackground & Drug Screening Disclaimer\n© Argo Cyber Systems, LLC - All Rights Reserved\nArgo Cyber Systems, LLC is committed to maintaining a safe, secure, and trusted workplace for all employees and our federal clients. Employment with Argo Cyber Systems is contingent upon successful completion of all required background investigations and pre-employment screenings, which may include, but are not limited to:\n\n \n Criminal background checks (federal, state, and local)\n \n Employment and education verification\n \n Reference checks\n \n Drug screening (in compliance with federal and state law)\n \n Security clearance verification (as applicable for classified positions)\n\nCandidates selected for employment in positions requiring access to sensitive or classified information may also be subject to additional U.S. Government background investigations and security adjudication processes, including DHS Entry on Duty (EOD) suitability or equivalent federal clearance requirements.\nArgo Cyber Systems reserves the right to disqualify or rescind an offer of employment based on the results of any background or screening process that, in the company's judgment, may impact an individual's ability to perform essential job functions or meet contractual obligations.\nAll background investigations and screenings are conducted in accordance with applicable federal, state, and local laws, including the Fair Credit Reporting Act (FCRA). Candidates will be notified of their rights and provided an opportunity to review and dispute any adverse findings before final employment determinations are made.\n\nJob Posted by ApplicantPro