Lead Detection Engineer, Cyber Defense & Response

What you'll do

• Design and implement enterprise-scale cyber threat detection capabilities across diverse cloud and on-premise platforms.
• Research adversarial TTPs to create proactive detection methodologies based on the MITRE ATT&CK framework.
• Partner with Cyber Threat Intelligence to operationalize intelligence into high-impact, sustainable detection coverage.
• Transform successful threat hunting activities into automated, scalable detections and long-term hypotheses.
• Architect and oversee the development of automation frameworks and reusable tools to increase team velocity.
• Identify and implement improvements for data visibility, infrastructure, and detection engineering tooling across the enterprise.
• Provide expert guidance on detection gaps and lead remediation efforts with platform owners and architects.
• Coach and mentor team members to foster technical excellence and advanced analytical rigor.

What we're looking for

• Extensive experience in detection engineering, incident response, threat hunting, or similar security operations roles.
• Expert understanding of risk-based alerting strategies and the ability to design enterprise-wide detection models.
• Deep knowledge of large enterprise architectures including networks, operating systems, cloud ecosystems, and telemetry pipelines.
• Expert-level understanding of adversarial frameworks such as MITRE ATT&CK and the Cyber Kill Chain.
• Advanced proficiency in Splunk Enterprise Security architecture, including correlation searches and risk frameworks.
• Advanced experience with SPL and KQL for designing scalable and maintainable detection libraries.
• Strong familiarity with SOAR, CI/CD, code repositories, and engineering pipelines.
• Preferred industry certifications such as GDAT, GCDA, GCTD, GCTI, GMON, GPEN, GCIH, GCFA, OSCP, OSCE, OSWE, or equivalent.