• Design, develop, and maintain security detections across SIEM, XDR, cloud, endpoint, and identity platforms.
• Build high-fidelity detection rules mapped to frameworks such as MITRE ATT&CK and other threat models.
• Develop and manage detection-as-code processes, including testing, version control, and automated deployments.
• Analyze security telemetry from multiple sources and create correlation rules to identify sophisticated attack patterns.
• Continuously tune and optimize detection logic to improve alert quality and reduce false positives.
• Research emerging threats, attacker techniques, and malware trends, and translate them into effective detection content.
• Conduct detection gap assessments and recommend improvements to increase security coverage.
• Collaborate with SOC, Incident Response, Threat Hunting, and Threat Intelligence teams to enhance detection capabilities.
• Support post-incident reviews and implement detection improvements based on lessons learned.
• Validate data quality, log sources, and telemetry availability required for effective threat detection.
• Develop dashboards, reports, and metrics to measure detection effectiveness, coverage, and performance.
• Contribute to automation initiatives that improve detection engineering and response workflows.
• Mentor junior team members and promote detection engineering best practices.

Requirements

• Bachelor's Degree in Cyber Security, Information Technology, Computer Science, or a related field.
• 7+ years of experience in Detection Engineering, Threat Hunting, Incident
• Response, SOC Engineering, or related cyber security roles.
• Hands-on experience with SIEM and XDR platforms such as Splunk, Microsoft Sentinel, Elastic, Stellar Cyber, or similar.
• Strong understanding of cyber threats, attack techniques, adversary behavior, and malware analysis.
• Experience developing detection rules using technologies such as KQL, Sigma, SPL, or equivalent query languages.
• Strong scripting skills in Python, PowerShell, or similar languages.
• Experience working with large log datasets and performing investigations using SQL or similar query languages.
• Knowledge of cloud security concepts across AWS, Azure, or GCP environments
• Experience with Git, CI/CD pipelines, and Detection-as-Code methodologies.
• Strong analytical, troubleshooting, and problem-solving skills.
• Excellent communication and stakeholder management abilities.

Preferred Qualifications

• Experience with SOAR platforms and automated response workflows.
• Experience with cloud-native threat detection and monitoring.
• Hands-on threat hunting experience.
• Familiarity with detection coverage mapping and security metrics.
• Industry certifications such as GCIH, GCFA, GCIA, CISSP, or Offensive Security certifications.
• Contributions to open-source detection content such as Sigma, YARA, or community detection repositories.