Detection Engineering Technical Leader

What you'll do

• Build and maintain scalable detection content and data models within Splunk Enterprise Security.
• Design and build data processing pipelines to transform high-volume security telemetry into actionable alerts.
• Integrate AI/ML techniques into detection engineering pipelines to reduce false positives and accelerate content development.
• Translate threat intelligence and ATT&CK-mapped behaviors into detection requirements with measurable success criteria.
• Develop automation to reduce manual toil in detection, triage, and response workflows.
• Perform code reviews and provide technical mentorship to elevate detection engineers and content developers.
• Drive cross-organizational initiatives to expand security visibility and close detection gaps.
• Build and tune security monitoring coverage across AWS, GCP, and Azure cloud environments.

What we're looking for

• Must be a U.S. Person (U.S. citizen, national, lawful permanent resident, asylee, or refugee).
• Bachelor’s degree plus 8 years of related experience, a Master’s degree plus 6 years, or a PhD plus 3 years as a security professional.
• Experience deploying and maintaining Splunk Enterprise Security content in a production SOC environment.
• Ability to build detection queries in SPL at scale, including risk-based alerting and statistical baselining.
• Experience integrating AI/ML techniques into detection engineering pipelines to reduce false positives.
• Ability to translate threat intelligence and ATT&CK-mapped behaviors into detection requirements with measurable success criteria.
• Experience with Git-based platforms, branch strategy, code reviews, and CI/CD integration (preferred).
• Experience building or tuning security monitoring across AWS, GCP, or Azure (preferred).