Senior Security Engineer - Detection Engineering

About the Role

Core Responsibilities

• Design, build, and operate high-signal detections across endpoint, identity, cloud, and SaaS environments.
• Implement and tune detection content and measure precision, recall, latency, lift, and signal-to-noise ratio.
• Build detections-as-code with version control, CI/CD, tests, canary rollouts, and rollback.
• Author SIGMA rules and translate them into KQL or SQL as needed.
• Integrate Azure, AWS, and GCP telemetry and operationalize Microsoft Defender XDR, Sentinel, and Entra ID signals.
• Conduct threat hunting, create hunt playbooks, and convert findings into detections.
• Build SOAR and Logic Apps automation for triage, enrichment, containment, and case workflows.
• Operationalize threat intelligence by normalizing indicators and tactics, techniques, and procedures.
• Own telemetry quality, schemas, enrichment, data contracts, and reliability objectives for assigned pipelines.
• Participate in incident retrospectives and on-call coverage for critical pipelines and high-severity investigations.

Basic Qualifications

• A bachelor's degree in cybersecurity, information security, computer science, or a related technical discipline, or equivalent practical experience, is required.
• At least 3 years of experience in security, detection engineering, or incident response is required.
• Experience building detection content and analytics for SIEM, XDR, EDR, and cloud telemetry is required.
• Programming and query-language experience, including examples such as Python, KQL, SQL, or SPL, is required.
• Experience with detections-as-code, testing, CI/CD, canary releases, and rollback is required.
• Experience with attacker TTPs, detection efficacy metrics, schemas, data models, and telemetry pipelines is required.

Preferred Qualifications

• A BS with 8+ years, MS with 7+ years, or PhD with 4+ years of relevant experience is preferred.
• Large-scale multi-region detection operations, testing harnesses, synthetic signals, and adversary emulation experience are preferred.
• Experience with identity and security signals, endpoint internals, SaaS logs, or applied analytics and machine learning is preferred.
• Experience with AI-enabled attack patterns and using AI to improve detection workflows is preferred.

Suggested Technical Skills

• Microsoft Sentinel, Defender XDR, Entra ID, KQL, Python, GitHub Actions, Azure DevOps, Logic Apps, and Azure Data Explorer or Kusto are listed as relevant technologies.
• Azure Activity and Diagnostics, AWS CloudTrail and GuardDuty, and GCP Cloud Audit Logs and SCC are relevant telemetry sources.

Compensation

• The listed pay range is $129,000 to $212,000 per year.
• Total compensation may include an annual performance bonus, stock, benefits, and other applicable incentive compensation.