Senior Detection Engineer
Job ID: 2617981
Location: Remote Work, TN, United States
Date Posted: Oct 16, 2026
Category: Cyber
Subcategory: Cybersecurity Ops
Schedule: Full-Time
Shift: Day Job
Travel: No
Minimum Clearance Required: None
Clearance Level Must Be Able to Obtain: None
Potential for Remote Work: Remote
Benefits: Click here
Share:
Job Description
Description
SAIC has an opening for a Senior Detection Engineer. This position is located in Oak Ridge, Tennessee; however, SAIC is open to remote work for qualified candidates. This role serves as a Senior Technical Analyst within SAIC’s Enterprise Security Operations Center (ESOC) and Detection Engineering Team. Reporting to the Manager of Defensive Cyber Operations (DCO), the Senior Analyst is responsible for enhancing enterprise-wide threat detection capabilities. The Senior Analyst develops high-fidelity detections on an operational cadence across SIEM, EDR, and other security telemetry platforms, ensuring SAIC maintains strong visibility into adversary tactics and emerging threats. In this position, the analyst works closely with the 24/7 Detection and Response, Cyber Incident Response, Cyber Threat Intelligence, Offensive Security Operations, and Sustainment teams to operationalize detections and continuously strengthen the organization’s defensive posture. In addition to advanced threat analysis and detection engineering responsibilities, the Senior Analyst mentors Detection Engineering analysts and collaborates across teams to support capability development, detection tuning, and documentation improvements. This includes contributing to continuous improvement initiatives and participating in cross-team knowledge-sharing activities that align with broader ESOC and DCO operational objectives. The position will work a 4×10 schedule, 07:00 a.m. EST – 5:00 p.m. EST, Monday–Thursday, with the expectation to support 24/7/365 operations when required.
Job Duties:
- Operationally develop, deploy, and maintain high‑fidelity detections across SIEM, EDR, and other security telemetry platforms to support continuous monitoring and response.
- Work closely with the Detection & Response team to validate alerts, refine workflows, and ensure engineered detections align with operational needs and real‑world analyst workflows.
- Provide rapid detection‑focused support during active incidents, including tuning recommendations, data enrichment, and technical guidance for investigation teams.
- Conduct ongoing tuning and optimization to improve detection fidelity, reduce false positives, strengthen efficiency, and close visibility gaps across the enterprise.
- Perform advanced threat and telemetry analysis to confirm detection performance, identify adversary behaviors, and ensure coverage of emerging threats.
- Operationalize Cyber Threat Intelligence (CTI) by translating observed TTPs, indicators, and behavioral patterns into reliable, actionable detections aligned with DCO mission requirements.
- Partner with CTI, Offensive Security Operations (OSO), and Purple‑Team operators to validate detection logic through adversary emulation, exercise detection coverage, and refine monitoring gaps identified during testing.
- Convert threat‑hunting discoveries, vulnerability insights, and purple‑team findings into improved detection logic, analytics, and monitoring enhancements.
- Maintain clear documentation for detection logic, tuning actions, workflows, and operational standards to support consistency and repeatability across the SOC.
- Mentor Detection Engineering analysts and support development of Detection & Response personnel to strengthen operational capability and readiness.
- Contribute to ESOC/DCO improvement initiatives, including engineering sprints