> Markdown version of [/jobs/ext/1318648-content-developer-siem-cyber-security](https://www.wearedevelopers.com/jobs/ext/1318648-content-developer-siem-cyber-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Content Developer (SIEM Cyber Security) - **Company:** STS Systems Defense, LLC - **Location:** San Antonio, TX, United States - **Contract:** Permanent contract - **Skills:** Cyber Security, Intrusion Detection Systems, Python (Programming Language), Machine Learning, Network Forensics, Windows PowerShell, ArcSight SIEM Tool, Security Information and Event Management, Scripting, Mitre Att&ck, Information Technology, Free and Open-Source Software, Splunk - **Published:** July 17, 2026 - **Apply:** https://www.dice.com/job-detail/c01c9141-9f25-4012-b966-132f8f5fa014 ## About the Role * DoDD 8570.01-M/8140.01 I AT Level III CND * Active TS/SCI * GMLE Certification (GIAC Machine Learning Engineer) OR Degree in Computer Science * More than 5 years of SIEM technology such as ArcSight, Splunk, and/or ELK. * More than 3 years with network traffic analysis, ports, and protocols. BA/BS or MA/MS * More than five (5) years of SIEM technology such as Arcsight, Splunk and/or ELK. Including, but not limited to, log handling, reports, filters, rule creation. * Extensive knowledge with IDS/IPS systems currently in use by the Department of Defense (DoD), Services, and Agencies (i.e., Air Force, Navy, Army, DC3, DISA). * More than three (3) years of experience with Network Traffic Analysis; ports and protocols. SANS GCDA or equivalent certification(s). * Extensive knowledge of MITRE ATT&CK framework, and its uses within the cybersecurity community (e.g., Open Source projects) Desired: * Additionally, more than one (1) year of experience with Security, Orchestration, Automation, and Response (SOAR) platforms such as Phantom and/or Demisto. Proficient in Python and PowerShell. ## Description STS Systems Defense, LLC (SSD) is a government consulting and contracting firm supporting federal agencies and military installations across the U.S. We are seeking a Content Developer (SIEM Cyber Security) at Lackland AFB in San Antonio, TX. What You'll Do: * Analyze DCO events. * Apply current industry SIEM best-practices. * Use security alerts correlated with log enrichment data to enhance the operator's ability to identify real attacks. * Establish security control effectiveness and monitor for unauthorized outbound connections * Create detections by analyzing log data across the enterprise. (CDRL A007) * Develop dashboards and visualizations to identify adversarial activity. (CDRL A007) * Use log data to establish and implement virtual tripwires for early detection. * Analyze and ingest security logs into the SIEM in order to optimize for performance of the SIEM. * Conduct designing, implementing, and testing of various SIEM solutions. (CDRL A007) * Create and support the creation of SIEM Use Cases and understand what alerts and log enrichment is necessary to meet the required acceptable false positive rate. (CDRL A008) * Create, test, and validate filters and rules. (CDRL A007) * Build and implement event correlation rules, logic, and content in the SIEM. (CDRL A007) * Tune SIEM event correlation rules and logic to filter out security events associated with known and well established network behavior, known false positives and/or known errors. * Analyze malware threats to develop behavior based detections that alert and/or prevent malicious activity. * Automate tasks in the SIEM using a common programming or scripting language. * Create scheduled and ad-hoc reporting with SEIM tools. (CDRL A007 and A008) * Create and maintain SIEM documentation. (CDRL A008) * Develop and execute a process to review and maintain SIEM resources such as rules, filters, lists, trends and reports. * Utilize SIEM to develop metrics collection, analysis, and create reports upon request. * Provide training to government personnel as requested. * Provide knowledge transfer of tools, processes and procedures to government personnel as requested. * Provide OJT to other contractor employees, military, and/or civilian personnel, and ensure continuity folders/working aids are updated at least once per quarter in order to ensure efficient transition when personnel rotate. * Maintain currency on latest industry trends and provide operational reports/assessments for development of tactics, techniques, and procedures. (CDRL A002) * Create, document, and report metrics for analysis to improve weapon system processes and mission execution. (CDRL A009). * Support operational leaderships tasking as it relates to Content Development functions and responsibilities ## Related Videos - [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [The Developer Workstation Blind Spot: Why Your Security Stack Can't See What Matters Most](https://www.wearedevelopers.com/videos/100254-the-developer-workstation-blind-spot-why-your-security-stack-can-t-see-what-matters-most) - [Intermediate Bitcoin Script](https://www.wearedevelopers.com/videos/25-intermediate-bitcoin-script) - [Oops! Stories of supply chain shenanigans](https://www.wearedevelopers.com/videos/245-oops-stories-of-supply-chain-shenanigans) ## Related Articles - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 216: CyberSec + Mythos, Stack Overflow for Agents & DOOM in TTF](https://www.wearedevelopers.com/magazine/728-dev-digest-216-cybersec-mythos-stack-overflow-for-agents-doom-in-ttf) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)