Specialist, Cyber Detection Engineer

What you'll do

• Design and maintain enterprise threat detection capabilities across on-prem and cloud environments.
• Author and maintain custom detection content using SIEM and XDR platforms.
• Transform threat intelligence and purple-team results into new detection content and coverage improvements.
• Validate detections using realistic attack scenarios and safe adversary simulations.
• Identify telemetry gaps and work with infrastructure teams to remediate log data quality issues.
• Develop temporary analytics and scoping queries to support active Incident Response investigations.
• Manage the full lifecycle of detection content including metrics, reporting, and continuous improvement.

What we're looking for

• 3+ years of experience in detection engineering, incident response, threat hunting, or security operations in large enterprise environments.
• Practical experience working with common Endpoint, Identity, Network, Cloud, and SaaS technologies and associated logging.
• Proven experience developing detection content across multiple telemetry sources.
• Strong proficiency with at least one major SIEM/XDR ecosystem and advanced query authoring (Splunk SPL, Microsoft KQL, SQL strongly preferred).
• Solid understanding of adversary tradecraft with practical experience applying MITRE ATT&CK to detection design, validation, and coverage assessment.
• Experience using common scripting languages like Python or PowerShell to solve problems, automate tasks, and interact with REST/GraphQL APIs.
• Strong written and verbal skills to communicate effectively with both technical and non-technical stakeholders.
• GIAC GDAT, GCDA, GCTD, GCTI, GMON, GCIH, GCFA, GCPY, Splunk Power User, Microsoft SC-200, AZ-500, or CompTIA CySA+ (preferred).