Senior Security Engineer, Cloud Threat Detection

What you'll do

• Design, develop, test, and deploy detection content for AWS and GCP threats.
• Integrate and normalize cloud security telemetry from AWS and GCP into the enterprise SIEM.
• Create and maintain SIEM detections, risk-based analytics, dashboards, and alerting content.
• Tune and optimize detection logic to reduce false positives and improve coverage.
• Map detections to MITRE ATT&CK and participate in adversary emulation and purple team exercises.
• Develop detection requirements and enrichment strategies to support AI/SOAR automation.
• Create and maintain SOPs, runbooks, and investigation guides for cloud-based alerts.
• Train and mentor SOC analysts on cloud attack techniques and investigation workflows.

What we're looking for

• 5+ years of cybersecurity experience in security operations, incident response, threat detection, or detection engineering.
• Hands-on operational experience securing both AWS and Google Cloud Platform (GCP) environments.
• Strong knowledge of AWS and GCP security services and cloud attack methodologies.
• Experience developing and tuning enterprise SIEM detections using cloud telemetry.
• Experience integrating cloud-native security tools and log sources into platforms like Splunk, Microsoft Sentinel, or QRadar.
• Experience training and mentoring SOC analysts on cloud threat investigation and triage processes.
• Ability to create operational documentation, investigation guides, SOPs, and analyst playbooks.