below marketmost similar roles pay hereabove market
This role pays less than
84%
of similar roles. Most pay
$158,825–$229,106
— the blue band above.
At the midpoint, this role pays about
$148k
versus about
$194k
for comparable roles.
Based on 240 similar postings.
Employer
About S&P Global
S&P Global delivers Essential Intelligence® that shapes decision making. We provide the world’s leading organizations with the right data, connected technologies and expertise they need to move ahead.
S&P Global currently has
39 open roles
on FindRole.
Listed pay typically runs
$145,245–$200,000
across 36 roles with salary data.
JOB TITLE: Detection Engineer
The Detection Engineer joins the IT - SGA CYBER DEFENSE team to protect critical assets against evolving cyber threats. This role involves designing and developing advanced detection logic for SIEM platforms, EDR solutions, cloud security tools, and network monitoring systems. You will map adversary tactics using the MITRE ATT&CK framework, tune rules to minimize false positives, and implement Detection-as-Code methodologies using version control, automated testing, and CI/CD pipelines. Key responsibilities include validating defenses through red team collaboration and mentoring junior members. Required skills include proficiency in Python, PowerShell, or Bash, along with query languages like SQL, SPL, and KQL. You will utilize technologies such as Splunk, QRadar, CrowdStrike, and Microsoft Sentinel to interpret telemetry data across networks, operating systems, and cloud environments.
Design and develop advanced detection logic for SIEM, EDR, cloud security, and network monitoring platforms.
Map adversary tactics and procedures using the MITRE ATT&CK framework to create real-time security alerts.
Tune and optimize detection rules to minimize false positives and reduce alert fatigue for analysts.
Implement Detection-as-Code methodologies using version control, automated testing, and CI/CD pipelines.
Validate security defenses through collaboration with red teams and automated breach simulation tools.
Lead cross-functional initiatives to enhance security posture and mentor junior team members.
What we're looking for
Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or equivalent professional experience in security engineering roles.
5+ years of hands-on experience in cybersecurity.
2+ years of experience focused on detection engineering, threat hunting, or security operations.
Proficiency in programming and scripting languages such as Python, PowerShell, or Bash.
Proficiency in query languages including SQL, SPL (Splunk), KQL (Microsoft Sentinel), or similar platforms.
Experience with SIEM platforms (Splunk, QRadar, or Microsoft Sentinel), EDR solutions (CrowdStrike, SentinelOne, or Microsoft Defender), and network security monitoring tools.
Demonstrated knowledge of MITRE ATT&CK framework to translate threat intelligence into actionable detection rules.
Experience with log analysis, telemetry data interpretation, and understanding data flows across networks, operating systems, cloud environments, and identity providers.
Advanced certifications such as GCIH, GCFA, CISSP, or cloud security certifications (preferred).
Experience implementing Detection-as-Code using version control (Git, GitLab, or Azure DevOps), CI/CD pipelines, and automated testing (preferred).
Hands-on experience with threat hunting, red team exercises, or penetration testing (preferred).
Knowledge of AI and machine learning applications in cybersecurity (preferred).