Senior Security Engineer, Cloud Threat Detection

What you'll do

• Design, develop, and deploy detection content for AWS and GCP threats.
• Integrate and normalize cloud security telemetry from AWS and GCP into the enterprise SIEM.
• Create and maintain SIEM detections, risk-based alerts, dashboards, and alerting content.
• Tune and optimize detection logic to reduce false positives and improve coverage.
• Map detections to MITRE ATT&CK and specific cloud attack techniques.
• Participate in adversary emulation and purple team exercises to validate detection effectiveness.
• Create standard operating procedures, runbooks, and investigation guides for cloud alerts.
• Train and mentor SOC analysts on cloud attack techniques and investigation workflows.

What we're looking for

• 5+ years of cybersecurity experience in security operations, incident response, threat detection, or detection engineering.
• Hands-on operational experience securing both AWS and Google Cloud Platform (GCP) environments.
• Experience developing and tuning enterprise SIEM detections using cloud telemetry.
• Experience integrating cloud-native security tools and log sources into platforms like Splunk Enterprise Security, Microsoft Sentinel, QRadar, or Cortex XSIAM.
• Strong understanding of cloud attack methodologies, identity compromise, privilege escalation, persistence, lateral movement, and data exfiltration.
• Ability to create operational documentation, investigation guides, SOPs, and analyst playbooks.
• Experience training and mentoring SOC analysts on cloud threat investigation and triage processes.