Senior Detection Engineer

This is a fully remote position, open to applicants in Tennessee.

📋 Description

• Design, implement, and sustain high-fidelity detections across SIEM, EDR, and various security telemetry systems.

• Verify alerts, refine workflows, and ensure detections meet the needs of operational analysts.

• Offer detection-centric support during active incidents, providing tuning advice, data enrichment, and technical guidance.

• Adjust and enhance detections to increase fidelity, minimize false positives, enhance efficiency, and address visibility gaps.

• Conduct advanced analysis of threats and telemetry to validate detection efficacy and recognize adversary behaviors.

• Convert cyber threat intelligence, TTPs, indicators, and behavioral trends into practical detections.

• Collaborate with CTI, Offensive Security Operations, and Purple-Team members to validate detection logic via adversary emulation.

• Transform threat-hunting discoveries, vulnerability insights, and purple-team results into enhanced detection logic and monitoring strategies.

• Keep documentation updated for detection logic, tuning activities, workflows, and operational standards.

• Guide Detection Engineering analysts and assist in the development of Detection & Response personnel.

• Participate in ESOC/DCO improvement initiatives, engineering sprints, automation, onboarding detection content, and process enhancement.

• Lead post-incident reviews of detections and enhance detection coverage.

• Improve ESOC dashboards, analytics, and tools for monitoring, triage, and investigations.

• Provide 24/7/365 operational support during high-priority events.

• Execute additional operational responsibilities as assigned.

⛳️ Requirements

• Bachelor’s degree with 5+ years of relevant experience, or a Master’s degree with 3+ years of relevant experience.

• An extra 4+ years of experience may be accepted in place of a degree.

• At least 3 years of experience in cybersecurity operations working with the enterprise SIEM Splunk.

• Must hold CySA+, SSCP, or an equivalent certification.

• Required to attain Splunk Certified Cybersecurity Defense Engineer certification within six months of hiring.

• Advanced skills in Splunk SPL and Python for security automation and workflow creation.

• Strong leadership abilities to effectively guide and inspire a team.

• Exceptional verbal and written communication skills.

• Capability to multitask and collaborate to address complex technical challenges.

• Must support 24/7/365 operations as necessary.

🏝️ Benefits

• Remote work option available for qualified applicants.

• 4×10 work schedule, Monday through Thursday, from 07:00 a.m. EST to 5:00 p.m. EST.

• Opportunity to mentor analysts and contribute to professional skill development.