Senior Detection Engineer (AI-ML Focus)

Design, build, test, and tune detection rules mapped to MITRE ATT&CK, prioritized by threat intelligence and business risk

Write detection logic across the SIEM and data lake platforms

Manage detection content as code — Git-based workflows, PR reviews, CI/CD deployment pipelines

Investigate and suppress false positives systematically using lookup-based architectures

Collaborate with Threat Hunting and Threat Intelligence teams through structured handover processes (TI→TH→DE pipeline)

Monitor emerging threats and rapidly develop detections for new TTPs, CVEs, and active campaigns

Leverage AI agents and LLM-assisted workflows to accelerate detection rule development, validation, and coverage analysis

Use and contribute to MCP (Model Context Protocol) tooling that enables AI-assisted detection validation (e.g., querying telemetry, assessing LOLBAS/GTFOBins, checking coverage gaps)

Operate agentic pipelines that triage large rule libraries against live telemetry at scale

Apply AI/ML techniques where appropriate for anomaly detection, behavioral analytics, or pattern identification in security datasets

Stay current on frontier AI threats (agentic attacks, LLM-assisted exploitation, AI-generated phishing) and translate them into detection opportunities

Work closely with SOC analysts to understand alert quality feedback and drive fidelity improvements

Collaborate with data engineers on telemetry availability, data quality, and log source onboarding

Contribute to detection coverage reporting and MITRE ATT&CK posture measurement

Document detection logic, tuning rationale, and suppression decisions

Job Qualifications

Technical Competencies and Experience:

Required:

Bachelor’s degree in Information Systems, Information Technology (IT), Computer Science, Engineering, or other technical / IT field and / or at least 5+ years of relevant experience in detection engineering, security operations, or threat detection roles

Proven experience writing and tuning SIEM detection rules/analytics (correlation rules, scheduled queries, real-time alerts)

Strong understanding of MITRE ATT&CK framework and its application to detection coverage

Proficiency in Python for automation, scripting, and tooling

Experience with git-based workflows (branching, PRs, CI/CD) for managing security content

Familiarity with security log sources: EDR, identity, cloud, network, proxy

Strong analytical skills and ability to distinguish true threats from noise in large datasets

Preferred:

Certifications CISSP, CCSP, OSCP, GIAC Certified Detection Analyst (GCDA), GCIA, Relevant certifications in cloud & ML/AIExperience with multiple query languages are helpful but not required

Experience with detection-as-code practices and YAML-based rule formats (Sigma, custom schemas)

Working knowledge of AI/LLM capabilities and their security implications — both as detection targets and as engineering tools

Experience with MCP servers, GitHub Copilot, or other AI-assisted development workflows

Familiarity with SOAR platforms and their integration with detection pipelines

Understanding of Kubernetes, cloud-native architectures, and OT/ICS environments

Compensation for roles at P&G varies depending on a wide array of non-discriminatory factors including but not limited to the specific office location, role, degree/credentials, relevant skill set, and level of relevant experience. At P&G compensation decisions are dependent on the facts and circumstances of each case. Total rewards at P&G include salary + bonus (if applicable) + benefits. Your recruiter may be able to share more about our total rewards offerings and the specific salary range for the relevant location(s) during the hiring process.

We are committed to providing equal opportunities in employment. We value diversity and do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.

Immigration Sponsorship is not available for this role. For more information regarding who is eligible for hire at P&G along with other work authorization FAQ’s, please click HERE.

Procter & Gamble participates in E-Verify.

Qualified individuals will not be disadvantaged based on being unemployed.

P&G is dedicated to meeting the needs of applicants requesting an accommodation/adjustment due to a disability in order to complete the online application process. If you have a disability that affects your ability to complete our online application process, please visit our Disability Accommodation Page.

Job Schedule

Job Number

Job Segmentation

Starting Pay / Salary Range