Detection Coverage Cybersecurity Jobs

1 job found

Today

Cyber Intel Analyst / Penetration Tester

ENSCO, Inc. Colorado Springs, CO

Colorado Springs, CO

Today

$85k - $115k/yr Full time Cybersecurity Operations Cybersecurity Tools Defensive Cyber Operations

Apply Now

Job Description

ENSCO, Inc. is seeking an on-site Cyber Intel Analyst / Penetration Tester to support Defensive Cyberspace Operations for Space (DCO-S) in Colorado Springs, Colorado. In this role, you will help strengthen visibility and detection for critical U.S. Space Force mission systems by aligning telemetry with adversary behavior and MITRE ATT&CK techniques.

You will evaluate detection coverage, develop threat-informed products and detection logic, and validate whether security data collected by sensors is usable for operators. Work includes purple-team support and security data validation across collection, parsing, normalization, enrichment, ingestion, indexing, storage, search, and visualization.

What you’ll do

Analyze endpoint, network, system, and security-event telemetry to identify detection opportunities and visibility gaps across DCO-S platforms.
Map mission-relevant threats, telemetry, and detections to MITRE ATT&CK.
Develop and maintain ATT&CK Navigator layers, detection-coverage heatmaps, and related threat-informed visualizations.
Assess adversary TTP coverage and classify techniques as fully covered, partially covered, unobserved, or unassessed.
Develop, test, document, tune, and automate detection logic, queries, scripts, and repeatable analytical processes.
Evaluate and validate security data from sensor collection through parsing, normalization, enrichment, ingestion, indexing, storage, search, and visualization.
Translate findings into operator guidance, including recommended searches, analytical methods, and relevant data sources.
Support purple-team and threat-emulation activities by determining whether simulated adversary actions produce expected telemetry and detections.
Document detection gaps, mission risks, and corrective actions for both technical and leadership audiences.
Collaborate with cyber operators, intelligence analysts, system administrators, network engineers, quality-control personnel, and mission stakeholders to improve detection methodologies and testing procedures.
Travel up to 10% to CONUS and OCONUS locations at the direction of the government customer.

Required qualifications

Bachelor’s degree in cybersecurity, computer science, information technology, engineering, data science, or a related field, plus 3+ years of relevant experience (equivalent education, military training, certifications, and professional experience will be considered).
Experience in detection engineering, threat hunting, incident response, network defense, security analytics, or SOC operations, including hands-on investigation, SIEM querying, detection tuning, threat hunting, telemetry analysis, or log-source validation.
Experience applying MITRE ATT&CK to adversary TTPs, telemetry, detection logic, and coverage-gap analysis.
Experience analyzing endpoint, network, system, or security-event data using SIEM, EDR, network-security-monitoring, or comparable analytics platforms.
Ability to develop and refine detection logic, queries, scripts, visualizations, and repeatable analytical processes.
Ability to evaluate whether security data is properly collected, parsed, normalized, enriched, indexed, searchable, and available to cyber operators.
Strong analytical, problem-solving, organizational, communication, and collaboration skills.
Ability to document and present complex technical findings to operator, engineering, mission, and leadership audiences.
Proficiency with Microsoft Word, Excel, and PowerPoint.
Must meet DoD 8140 qualification requirements for the assigned DCWF work role and proficiency level through an approved certification.
Active DoD Top Secret security clearance with SCI eligibility and U.S. citizenship required.

Preferred qualifications

Experience supporting DoD, USSF, DCO-S, intelligence-community, or other mission-system environments.
Experience with ATT&CK Navigator, purple-team exercises, adversary emulation, detection-as-code, or Sigma.
Experience with Bash scripting.
Current Security+, CySA+, or other certification approved for the assigned DCWF work role and proficiency level.

Additional information

Location: Colorado Springs, CO (onsite)
Salary: USD 85,000 - 115,000 per year
Technologies: MITRE ATT&CK, ATT&CK Navigator, SIEM, EDR, network-security-monitoring, Microsoft Word, Microsoft Excel, Microsoft PowerPoint, DoD 8140
REAL ID requirement: This position may require access to U.S. federal facilities; individuals must present REAL ID-compliant identification or an acceptable alternative.
Benefits: ENSCO offers a comprehensive benefits package (see ensco.com/careers/benefits).
Export control and licensing: Access to technology or technical data controlled under U.S. export control laws may be required; release to a non-U.S. person may require an export license.
Privacy: ENSCO privacy policy applies; California residents may click for California privacy rights.

View full job page →

Get Detection Coverage Cybersecurity Jobs alerts

New Detection Coverage Cybersecurity Jobs, daily.