Correlation Engineer

We are seeking a highly skilled and innovative Correlation Engineer to join our team in the greater DMV area, supporting the Army National Guard.

Responsibilities

• Design, develop, and refine correlation logic and detection content for SIEM and analytics platforms to link events, logs, and telemetry into actionable security narratives.
• Analyze threat trends, historical incidents, and attack patterns to create correlation scenarios that reveal multi‑stage campaigns, lateral movement, insider activity, and stealthy behaviors.
• Test, tune, and validate correlation rules to balance detection coverage against analyst workload; document rule behavior, performance characteristics, and operational runbooks.
• Collaborate with SOC analysts, threat hunters, data engineers, and tool owners to improve data quality, field mappings, normalization, and telemetry enrichment for robust correlation.
• Implement automated enrichment, suppression, and tuning strategies to reduce false positives and optimize alert fidelity.
• Maintain correlation content lifecycle: version control, peer review, QA testing, deployment, and rollback procedures.
• Develop metrics and dashboards to measure correlation efficacy (precision, recall, MTTD) and drive continuous improvement.
• Lead post‑incident correlation analysis to derive new detection use cases and inform detection engineering priorities.
• Provide training and documentation to SOC staff on new correlation logic, investigative workflows, and case escalation procedures.

#ENOCS

Qualifications

• Minimum of 8 years with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD

• Clearance: Active TS/SCI clearance.

• Candidate must meet ONE of the following:

  • Master’s degree or Ph.D. in Computer Science, Cybersecurity, Data Science, Information Systems, Information Technology, Software Engineering, or a related field; OR
  • Relevant DoD/military training (example: 4C‑255N (CP)); OR
  • Relevant professional certification or equivalent experience (examples: CISSP‑ISSAP, CISSP‑ISSEP, GCIA, GICSP).

• Required experience and skills:

  • Cybersecurity analytics, detection engineering, or SOC content development experience with at least 3 years focused on correlation rule development for enterprise SIEMs.
  • Deep understanding of log formats, telemetry sources (network, endpoint, cloud, identity), normalization/mapping, and analytic pipelines.
  • Proven ability to author complex correlation logic, detection rules, and analytic queries (KQL, SPL, Sigma, or vendor‑specific languages).
  • Experience with testing frameworks, rule performance tuning, false‑positive mitigation, and operationalizing detections into SOC playbooks.
  • Strong collaboration skills with data engineering and platform teams to ensure ingestion quality and scalable analytics.
  • Capability to produce decision‑grade documentation, runbooks, and measurable detection KPIs.

• Desired:

  • Prior DoD/enterprise SOC detection engineering experience and familiarity with MITRE ATT&CK mapping for correlation use cases.
  • Experience with multiple SIEM platforms and analytics toolchains (Splunk, Elastic, QRadar, Sumo Logic, Microsoft Sentinel).
  • Background in threat hunting, adversary emulation, or purple‑team activities to validate and stress‑test correlation content.

#ENOCS