Correlation Engineer

We are seeking a highly skilled and innovative Correlation Engineer to join our team in the greater DMV area supporting the Army National Guard.

Responsibilities

• Design develop and refine correlation logic and detection content for SIEM and analytics platforms to link events logs and telemetry into actionable security narratives.
• Analyze threat trends historical incidents and attack patterns to create correlation scenarios that reveal multistage campaigns lateral movement insider activity and stealthy behaviors.
• Test tune and validate correlation rules to balance detection coverage against analyst workload; document rule behavior performance characteristics and operational runbooks.
• Collaborate with SOC analysts threat hunters data engineers and tool owners to improve data quality field mappings normalization and telemetry enrichment for robust correlation.
• Implement automated enrichment suppression and tuning strategies to reduce false positives and optimize alert fidelity.
• Maintain correlation content lifecycle: version control peer review QA testing deployment and rollback procedures.
• Develop metrics and dashboards to measure correlation efficacy (precision recall MTTD) and drive continuous improvement.
• Lead postincident correlation analysis to derive new detection use cases and inform detection engineering priorities.
• Provide training and documentation to SOC staff on new correlation logic investigative workflows and case escalation procedures.

#ENOCS

Qualifications

• Minimum of 8 years with BS/BA; Minimum of 6 years with MS/MA; Minimum of 3 years with PhD

• Clearance: Active TS/SCI clearance.

• Candidate must meet ONE of the following:

  • Masters degree or Ph.D. in Computer Science Cybersecurity Data Science Information Systems Information Technology Software Engineering or a related field; OR
  • Relevant DoD/military training (example: 4C255N (CP)); OR
  • Relevant professional certification or equivalent experience (examples: CISSPISSAP CISSPISSEP GCIA GICSP).

• Required experience and skills:

  • Cybersecurity analytics detection engineering or SOC content development experience with at least 3 years focused on correlation rule development for enterprise SIEMs.
  • Deep understanding of log formats telemetry sources (network endpoint cloud identity) normalization/mapping and analytic pipelines.
  • Proven ability to author complex correlation logic detection rules and analytic queries (KQL SPL Sigma or vendorspecific languages).
  • Experience with testing frameworks rule performance tuning falsepositive mitigation and operationalizing detections into SOC playbooks.
  • Strong collaboration skills with data engineering and platform teams to ensure ingestion quality and scalable analytics.
  • Capability to produce decisiongrade documentation runbooks and measurable detection KPIs.

• Desired:

  • Prior DoD/enterprise SOC detection engineering experience and familiarity with MITRE ATT&CK mapping for correlation use cases.
  • Experience with multiple SIEM platforms and analytics toolchains (Splunk Elastic QRadar Sumo Logic Microsoft Sentinel).
  • Background in threat hunting adversary emulation or purpleteam activities to validate and stresstest correlation content.

#ENOCS

Peraton is a next-generation national security company that drives missions of consequence spanning the globe and extending to the farthest reaches of the galaxy. As the worlds leading mission capability integrator and transformative enterprise IT provider we deliver trusted highly differentiated solutions and technologies to protect our nation and allies. Peraton operates at the critical nexus between traditional and nontraditional threats across all domains: land sea space air and cyberspace. The company serves as a valued partner to essential government agencies and supports every branch of the U.S. armed forces. Each day our employees do the cant be done by solving the most daunting challenges facing our customers. Visit to learn how were keeping people around the world safe and secure.