> Markdown version of [/jobs/ext/2822214-sitec-cyber-threat-detection-engineer-macdill-afb](https://www.wearedevelopers.com/jobs/ext/2822214-sitec-cyber-threat-detection-engineer-macdill-afb). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # SITEC - Cyber Threat Detection Engineer - MacDill AFB - **Company:** Peraton Inc - **Location:** Tampa, FL, United States - **Salary:** $80,000.0 - $128,000.0 - **Contract:** Permanent contract - **Skills:** Adobe Analytics, IMac, Cyber Security, Computer Telephony Integration, Intrusion Detection Systems, Network Architecture, Kusto Query Language, Security Information and Event Management, Computer Networking Systems, Computer Network Operations, In-Plane Switching (IPS), Mitre Att&ck, Mttr, Cyber Threat Analysis, Git, Information Technology, Microsoft Sentinel, Cyber Warfare, Splunk, Security Orchestration, Automation & Response - **Published:** September 10, 2026 - **Apply:** https://jobs.localjobnetwork.com/apply/add/88288276/1 ## About the Role * Min 12 years with HS degree, 10 years with AS/AA degree, 8 years with BS/BA, 6 years with MS/MA, 3 years with PhD * DoD 8570 IAT II Certification * DoW TS/SCI clearance * Must be DoW 8140 compliant under the Work Role Code 531- Cyber Defense Incident Responder - Intermediate level or higher Desired Qualifications: * Strong analytical and problem-solving skills * Ability to communicate security issues clearly to both technical and non-technical stakeholders * Strong understanding of security technologies used to defend Enterprise networks such as EDR, XDR, IDS, IPS, SIEM and SOAR. * Hands-on experience using SIEM solutions such as Splunk and Microsoft Sentinel to create threat detections. ## Description Peraton requires a Cyber Threat Detection Engineer to support the Special Operation Command Information Technology Enterprise Contract (SITEC) - 3 EOM. This position is located at MacDill AFB in Florida. The purpose of the Special Operations Forces Information Technology Enterprise Contract (SITEC) 3 Enterprise Operations and Maintenance (EOM) Task Order (TO) is to provide USSOCOM, its Component Commands, its Theater Special Operations Commands (TSOCs), and its deployed forces with Operations and Maintenance (O&M) services to maintain Network Operations (NetOps); maintain systems and network infrastructure; provide end user and common device support; provide configuration, change, license, and asset management; conduct training, and perform Install, Move, Add, Change (IMACs) services. The responsibilities and tasks associated with each requirement play a pivotal role to USSOCOM, the CIO/J6 organization, and ultimately the end-user who operate around the globe 24x7x365. The Cyber Threat Detection Engineer serves as the primary technical authority for designing, authoring, validating, and optimizing threat detection capabilities across enterprise cyber defense systems. Operating at the intersection of Threat Intelligence, Security Operations, and Security Engineering, this role is responsible for translating adversary tactics, techniques, and procedures (TTPs) into actionable, high-fidelity detection rules within Splunk Enterprise Security (ES) and orchestrated response workflows within enterprise SOAR platforms. The engineer ensures comprehensive visibility into enterprise telemetry, reduces alert fatigue for frontline SOC analysts by eliminating false positives, and adopts Detection-as-Code (DaC) principles to continuously test, maintain, and mature the organization's defensive posture., Design, build, test, and tune complex correlation searches, behavioral analytics, and threat detections within Splunk Enterprise Security (ES) utilizing advanced Splunk Search Processing Language (SPL), and Microsoft Sentinel with Kusto Query Language (KQL). * Map and continuously evaluate enterprise detection coverage against the MITRE ATT&CK framework to identify, prioritize, and remediate visibility and detection blind spots across endpoint, cloud, and network environments. * Collaborate with automation teams to design, test, and optimize automated SOAR playbooks that trigger on SIEM detections to enrich alerts, execute automated containment actions, and reduce Mean Time to Respond (MTTR). * Engineer and maintain bi-directional integrations between Splunk, Sentinel and SOAR platforms to ensure seamless alert handoffs, context ingestion, and closed-loop feedback for continuous alert tuning. * Conduct regular false-positive analysis and threshold tuning across all active detection rules to eliminate alert fatigue for frontline Security Operations Center (SOC) analysts. * Analyze cyber threat intelligence (CTI) reports, Indicators of Compromise (IOCs), and zero-day vulnerabilities to rapidly author high-priority detection signatures. * Maintain comprehensive detection documentation, including alert logic explanations, investigative runbooks, and triage guidance. * Manage detection logic as code within version-controlled repositories (e.g., Git) utilizing CI/CD pipelines to review, test, version, and deploy detection content into production environments. ## Related Videos - [What Developers Get Wrong About Application Quality](https://www.wearedevelopers.com/videos/233-what-developers-get-wrong-about-application-quality) - [How a Small Team Shrank a Microsoft Monorepo by 94%](https://www.wearedevelopers.com/videos/1236-how-a-small-team-shrank-a-microsoft-monorepo-by-94) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Git for Code Reviews](https://www.wearedevelopers.com/videos/429-git-for-code-reviews) - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Stop Committing Your Secrets - GIt Hooks To The Rescue!](https://www.wearedevelopers.com/videos/573-stop-committing-your-secrets-git-hooks-to-the-rescue) ## Related Articles - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 191: Malware interviews, EU ❤️ Open Source and Skilled Agents](https://www.wearedevelopers.com/magazine/645-dev-digest-191-malware-interviews-eu-open-source-and-skilled-agents) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)