Detection Engineering Lead

About the role

MANTECH seeks a motivated and customer-oriented Cyber Detection Engineering Lead to join our team in McLean, VA. In this role you lead the mission to enhance cybersecurity detection and response capabilities by developing high-fidelity detection logic, automating security workflows, and strengthening threat-hunting operations. This role serves as a technical leader and liaison with customer staff, overseeing project and task workflow while improving the organization’s ability to identify, analyze, and respond to evolving cyber threats.

Responsibilities

• Develop, optimize, and deploy custom detection rules across SIEM platforms and create signatures and detection rules for malware and network-based threats
• Build, test, and tune security analytics pipelines to reduce false positives and improve alert fidelity
• Design and implement SOAR playbooks to streamline and enhance security operations
• Automate threat intelligence ingestion, correlation, and alerting mechanisms
• Develop integration scripts between security tools and data sources to enhance visibility and response capabilities
• Develop and maintain robust detection logic mapped to MITRE ATT&CK techniques
• Conduct continuous security log analysis to identify anomalies and potential threats
• Collaborate with Incident Response teams to provide detection logic for emerging threats
• Leverage EDR solutions to detect and investigate endpoint threats
• Analyze Windows internals and system logs to identify malicious activities and forensic artifacts
• Serve as a liaison with customer staff and oversee project and task workflow to ensure successful mission execution

Minimum Qualifications

• High School Diploma and 7+ years of experience in cybersecurity with a focus on detection engineering, threat hunting, incident response, or CNO/CNE
• Experience with Python or a similar language for automation and data analysis
• Hands-on experience with SIEM platforms such as Splunk, ELK, Sentinel, Chronicle, or similar technologies
• Experience applying the MITRE ATT&CK framework for adversary tactics and techniques mapping
• Experience with YARA, Snort, Suricata, or other signature-based detection technologies
• Experience with Windows internals and forensic artifacts for endpoint security investigations

Preferred Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science or other relevant field
• Experience with SOAR solutions and security automation workflows
• Experience with threat intelligence platforms and integrating threat intelligence feeds into security operations
• Prior experience in penetration testing, red teaming, or reverse engineering
• Certifications such as GCDA, GCIH, GCFA, OSCP, or Splunk Certified Security Professional

Clearance Requirements

• Active/current TS/SCI with polygraph

Physical Requirements

• Must be able to remain in a stationary position 50% of the time