{"schemaVersion":"jobsearcher.job.v1","id":"3cacc8186e109e477b3e5705","url":"https://jobsearcher.com/jobs/3cacc8186e109e477b3e5705","canonicalUrl":"https://jobsearcher.com/jobs/3cacc8186e109e477b3e5705","title":"Cyber Content Developer","description":"CYBER CONTENT DEVELOPER/SIEM ENGINEER (33 NWS) - JBSA LACKLAND, SAN ANTONIO, TEXAS – TS/SCI REQUIRED\n\nJob Description\nThe Cyber Content Developer/SIEM Engineer implements use cases based on mission requirements that provide analysts with a manageable SIEM view of security incidents, complete with workflow and reporting. Additionally, provide proactive housekeeping of associated content (use cases) with consideration for revisions and/or decommissioning. Will be in close collaboration with DO and DM leadership to ensure tasks align with squadron requirements, priorities, and future initiatives.\n\nResponsibilities\nAnalyze DCO events.\nApply current industry SIEM best‐practices.\nUse security alerts correlated with log enrichment data to enhance the operator’s ability to identify real attacks.\nEstablish security control effectiveness and monitor for unauthorized outbound connections\nCreate detections by analyzing log data across the enterprise.\nDevelop dashboards and visualizations to identify adversarial activity.\nUse log data to establish and implement virtual tripwires for early detection.\nAnalyze and ingest security logs into the SIEM in order to optimize for performance of the SIEM.\nConduct designing, implementing, and testing of various SIEM solutions.\nCreate and support the creation of SIEM Use Cases and understand what alerts and log enrichment is necessary to meet the required acceptable false positive rate.\nCreate, test, and validate filters and rules.\nBuild and implement event correlation rules, logic, and content in the SIEM.\nTune SIEM event correlation rules and logic to filter out security events associated with known and well-established network behavior, known false positives and/or known errors.\nAnalyze malware threats to develop behavior-based detections that alert and/or prevent malicious activity.\nAutomate tasks in the SIEM using a common programming or scripting language.\nCreate scheduled and ad‐hoc reporting with SEIM tools.\nCreate and maintain SIEM documentation.\nDevelop and execute a process to review and maintain SIEM resources such as rules, filters, lists, trends and reports.\nBasic Qualifications\nAn active TS/SCI clearance.\nAbility to obtain the GIAC Machine Learning Engineer (GMLE) Certification within 120-days of hire date OR have a BS in Computer Science or MS in Computer Science/Cyber Security.\nPreferred Qualifications\n2+ years of SIEM technology (ex: Arcsight, Splunk, Devo and/or ELK).\nExperience with log handling, reports, filters, and rule creation.\nExtensive knowledge with IDS/IPS systems currently in use by the Department of Defense (DoD), Services, and Agencies (ex: Air Force, Navy, Army, DC3, DISA).\n3+ years of experience with Network Traffic Analysis; ports and protocols. SANS GCDA or equivalent certification(s).\nExtensive knowledge of MITRE ATT&CK framework, and its uses within the cybersecurity community (ex: Open Source projects).\n1+ year of experience with Security, Orchestration, Automation, and Response (SOAR) platforms such as Phantom and/or Demisto.\nProficient in Python and PowerShell.\nBenefits\nMedical, Dental, Vision, Unlimited Vacation, Sick Leave, Paid Federal Holidays, Education and Certification Reimbursement Program, 401(k) retirement plan with safe harbor employer match after 3 months, Prepaid legal plan and ID protection plan available, Accident Insurance, Critical Illness Insurance, and Hospital Indemnity Insurance available.\n\nEEOC Statement\nIPSecure does not discriminate based on race, color, religion, sex, sexual orientation, gender identity, national origin, disability or status as a protected veteran.","company":"Ipsecure","rawCompany":"ipsecure","city":"Washington","state":"DC","isRemote":false,"isActive":false,"createdAt":"2026-10-17T07:26:44.130Z","occupations":[{"code":"15-1299.05","title":"Information Security Engineers","slug":"information-security-engineers"},{"code":"15-1212.00","title":"Information Security Analysts","slug":"information-security-analysts"},{"code":"15-1299.08","title":"Computer Systems Engineers/Architects","slug":"computer-systems-engineers-architects"}],"industries":[{"code":"541512","title":"Computer Systems Design Services","slug":"computer-systems-design-services"},{"code":"928110","title":"National Security","slug":"national-security"},{"code":"922190","title":"Other Justice, Public Order, and Safety Activities","slug":"other-justice-public-order-and-safety-activities"}],"jobPosting":{"@context":"https://schema.org","@type":"JobPosting","title":"Cyber Content Developer","description":"CYBER CONTENT DEVELOPER/SIEM ENGINEER (33 NWS) - JBSA LACKLAND, SAN ANTONIO, TEXAS – TS/SCI REQUIRED\n\nJob Description\nThe Cyber Content Developer/SIEM Engineer implements use cases based on mission requirements that provide analysts with a manageable SIEM view of security incidents, complete with workflow and reporting. Additionally, provide proactive housekeeping of associated content (use cases) with consideration for revisions and/or decommissioning. Will be in close collaboration with DO and DM leadership to ensure tasks align with squadron requirements, priorities, and future initiatives.\n\nResponsibilities\nAnalyze DCO events.\nApply current industry SIEM best‐practices.\nUse security alerts correlated with log enrichment data to enhance the operator’s ability to identify real attacks.\nEstablish security control effectiveness and monitor for unauthorized outbound connections\nCreate detections by analyzing log data across the enterprise.\nDevelop dashboards and visualizations to identify adversarial activity.\nUse log data to establish and implement virtual tripwires for early detection.\nAnalyze and ingest security logs into the SIEM in order to optimize for performance of the SIEM.\nConduct designing, implementing, and testing of various SIEM solutions.\nCreate and support the creation of SIEM Use Cases and understand what alerts and log enrichment is necessary to meet the required acceptable false positive rate.\nCreate, test, and validate filters and rules.\nBuild and implement event correlation rules, logic, and content in the SIEM.\nTune SIEM event correlation rules and logic to filter out security events associated with known and well-established network behavior, known false positives and/or known errors.\nAnalyze malware threats to develop behavior-based detections that alert and/or prevent malicious activity.\nAutomate tasks in the SIEM using a common programming or scripting language.\nCreate scheduled and ad‐hoc reporting with SEIM tools.\nCreate and maintain SIEM documentation.\nDevelop and execute a process to review and maintain SIEM resources such as rules, filters, lists, trends and reports.\nBasic Qualifications\nAn active TS/SCI clearance.\nAbility to obtain the GIAC Machine Learning Engineer (GMLE) Certification within 120-days of hire date OR have a BS in Computer Science or MS in Computer Science/Cyber Security.\nPreferred Qualifications\n2+ years of SIEM technology (ex: Arcsight, Splunk, Devo and/or ELK).\nExperience with log handling, reports, filters, and rule creation.\nExtensive knowledge with IDS/IPS systems currently in use by the Department of Defense (DoD), Services, and Agencies (ex: Air Force, Navy, Army, DC3, DISA).\n3+ years of experience with Network Traffic Analysis; ports and protocols. SANS GCDA or equivalent certification(s).\nExtensive knowledge of MITRE ATT&CK framework, and its uses within the cybersecurity community (ex: Open Source projects).\n1+ year of experience with Security, Orchestration, Automation, and Response (SOAR) platforms such as Phantom and/or Demisto.\nProficient in Python and PowerShell.\nBenefits\nMedical, Dental, Vision, Unlimited Vacation, Sick Leave, Paid Federal Holidays, Education and Certification Reimbursement Program, 401(k) retirement plan with safe harbor employer match after 3 months, Prepaid legal plan and ID protection plan available, Accident Insurance, Critical Illness Insurance, and Hospital Indemnity Insurance available.\n\nEEOC Statement\nIPSecure does not discriminate based on race, color, religion, sex, sexual orientation, gender identity, national origin, disability or status as a protected veteran.","datePosted":"2026-10-17T07:26:44.130Z","dateModified":"2026-10-17T07:26:44.130Z","hiringOrganization":{"@type":"Organization","name":"Ipsecure","sameAs":"https://jobsearcher.com"},"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Washington","addressRegion":"DC","addressCountry":"US"}},"identifier":{"@type":"PropertyValue","name":"JobSearcher","value":"3cacc8186e109e477b3e5705"},"url":"https://jobsearcher.com/jobs/3cacc8186e109e477b3e5705"}}