What you’ll do (Responsibilities)
- Own and mature enterprise detection engineering end-to-end—setting standards, patterns, quality bars, and long-term technical direction across security telemetry and detections.
- Build and continuously improve high-fidelity detections across SIEM/EDR, identity, cloud, network, and SaaS environments—focused on scalability and resilience against evolving tradecraft.
- Lead complex, hypothesis-driven threat hunts and adversary emulation exercises, partnering with internal stakeholders to validate real-world detection and response effectiveness.
- Translate findings into durable improvements (not one-off wins): new detections, improved telemetry, response playbook enhancements, and defensive/architectural changes; serve as technical lead during high-severity incidents.
What you’ll bring (Requirements)
- 5–8+ years in security operations, detection engineering, threat hunting, and/or offensive security with a track record of tackling ambiguous, cross-functional security problems.
- Deep knowledge of adversary behaviors and detection techniques (e.g., mapping attacker tradecraft to practical detections across endpoint, identity, cloud, network, and SaaS).
- Hands-on experience with SIEM/EDR and large-scale log analytics, such as Google SecOps, Microsoft Defender XDR, CrowdStrike, and similar tooling.
- Strong scripting/automation capability (and the communication skills to explain technical risk clearly to security/technology leaders and business stakeholders).
(Preferred)
- Experience with Google SecOps SIEM, Microsoft security stack, and/or Proofpoint email security
- Windows/Linux administration background
- Security certifications (e.g., CISSP, CASP or related)
- Bachelor’s degree in Cybersecurity/Computer Science (or equivalent practical experience)
