Senior Detection Engineer (Next-Gen Threat Hunter)

Senior Detection Engineer (Next-Gen Threat Hunter) 

The modern threat actor moves in seconds or minutes, not days. We are shifting to a detections capability focused on where our data is located (SaaS platforms, automation pipelines, user-controlled data storage) and the knowledge that the future of our perimeter is identity based. As a Detection Engineer, you will not just operate security tools—you will design a high-fidelity system that makes our multi-cloud and on-prem environment inherently hostile to adversaries. This position will be its own customer, building and operating detections, growing from feedback in the field, and iterating. This position will spend (for rough example) 70% on engineering detections for automated attack chains and performing response and triage, with 15% on more traditional log reviews or IOCs, and 15% on strategy and modeling the adversary.  

Key Responsibilities: 

• Design Automated Logic: Design and implement high-fidelity detection pipelines that detect automated attack chains within minutes or seconds. 

• Build Behavioral Models: Shift focus from static indicators (like file hashes) to complex behavioral analytics and anomaly detection. 

• Secure Cloud Control Planes: Monitor and protect AWS and Azure infrastructure by tracking API calls, configuration drift, and identity-based movements. 

• Unify Threat Visibility: Dissolve boundaries between external attackers, non-human ID and insider threats by mastering the identity perimeter and focusing on potential credential activities. 

• Develop Security Code: Write production-grade Python and automated workflows in other scripting and automation languages/tools to turn manual threat-hunting hypotheses into instantiated detections code. 

• Map to Matrix Frameworks: Align detection logic with modern matrices like MITRE ATT&CK, focusing heavily on cloud, container, and identity techniques. 

• Construct Tripwires: Deploy deceptive assets, honey-tokens, and behavioral tripwires to detect adversary lateral movement or actions post-compromise. 

• Analyze API Telemetry: Deep-dive into application, Kubernetes, and cloud-service APIs to detect malicious API-shimming, data staging, and account takeovers. 

• Collaborate and Mentor SOC and IR: Lead analytics and incident response as SME to ensure clean response and containment, ingest post-mortem data and continuously harden detection logic against new variants. Mentor analyst and engineering staff in areas of expertise. 

• Optimize SIEM/XDR/XSIAM and Protections Pipelines: Refine data ingestion pipelines and engineer XSOAR playbooks to automatically triage and contain alerts with minimal analyst intervention. 

• Design for the Future/Work in the Present: Our protections/controls matrix are top notch. You will ensure that our stack stays positioned for the always-evolving future, but that we optimize our tools and capabilities as they exist today, getting the most for the dollars invested while planning for what's next. 

Candidate Prerequisites: 

• Cybersecurity Experience: 5+ years of progressive experience in cybersecurity, including experience in detection engineering, security operations, incident response, threat hunting, security engineering, or a related discipline. 

• Security Operations Expert: You have a background in technical/network security, systems and/or network engineering or cloud computing, and have done traditional SOC analyst work whether single-hatted or as a generalist role.  

• Operational Production Coding: Minimum 3+ years of experience writing clean automations and scripts in Python, Go, BASH, Helm, or PowerShell to manipulate APIs and data structures.  

• Multi-Cloud Architecture Expertise: Proven experience securing AWS and Azure control planes, specifically auditing IAM, storage access (e.g., S3, Azure Blobs), and cloud log management. 

• Container & Orchestration Security: Strong engineering experience with Kubernetes, including securing cluster control planes, monitoring Kube-audit logs, and analyzing container runtime telemetry. 

• Behavioral Threat Hunting: Demonstrated track record of hunting based on identity, behavioral baselines, and Living-off-the-Land (LotL) techniques rather than static signatures. 

• SOAR Automation Expert: Hands-on experience engineering automation playbooks, integrations, and orchestration flows specifically within Cortex XSIAM. 

Physical Requirements:

• Position requires long periods of sitting, typing, and participating in phone or video calls. 

On-call Requirements:

• Participation in a scheduled on-call rotation is a required responsibility of this position. On-call assignments typically occur once every four to five weeks and involve responding to security incidents, critical alerts, and potential threats that require investigation, triage, or containment outside of normal business hours.