Sr Detection Engineer II

Senior Security Detection & Automation Engineer

Role Overview

We are looking for a Senior Security Detection & Automation Engineer with 4 to 8 years of hands-on cybersecurity experience.

This role focuses on designing high-quality security detections, building scalable automation, integrating security technologies, and improving the efficiency and effectiveness of security monitoring. This is an core security position, not a Tier 1 or Tier 2 alert-monitoring role.

Key Responsibilities

Detection Engineering

Design, develop, test, deploy, and maintain security detections across endpoint, identity, cloud, network, email, and application environments.Translate threat intelligence, attacker behaviors, threat-hunting findings, and security risks into actionable detection logic.Develop behavioral, anomaly-based, and correlation-based detections across multiple data sources.Create detection content using Sigma, KQL, SPL, YARA, Suricata, or platform-specific query languages.Map detection coverage to MITRE ATT&CK and identify gaps across priority attack techniques and critical assets.Tune detections to improve fidelity, reduce false positives, and minimize unnecessary analyst workload.Define detection requirements, including data dependencies, logic, severity, confidence, response guidance, and ownership.Manage the complete detection lifecycle, from initial development through validation, deployment, maintenance, and retirement.Measure detection quality through coverage, precision, alert volume, false-positive rates, and detection performance.

Security Automation

Design and develop automation for alert enrichment, correlation, prioritization, evidence collection, case creation, and analyst recommendations.Automate repetitive Tier 1 and Tier 2 activities to improve analyst capacity and consistency.Build integrations between SIEM, EDR, XDR, SOAR, identity, cloud, threat intelligence, vulnerability management, ticketing, and communication platforms.Develop reusable scripts, APIs, services, connectors, and automation components using Python, PowerShell, or comparable languages.Implement reliable workflows with error handling, retry logic, logging, monitoring, auditability, and failure notifications.Apply appropriate access controls, secrets management, testing, approval points, and rollback capabilities.Evaluate AI-assisted security workflows with appropriate validation, evidence tracking, security controls, and human oversight.Measure automation value through reduced handling time, improved consistency, lower manual effort, and increased analyst capacity.

Detection-as-Code

Manage detection content through version-controlled detection-as-code practices.Build automated pipelines for detection validation, testing, deployment, and rollback.Create unit tests, regression tests, and simulation-based tests for detection logic.Validate detections against representative attack data and expected business activity.Conduct peer reviews of detection rules and automation code.Maintain clear documentation covering detection purpose, logic, telemetry requirements, ATT&CK mapping, testing evidence, known limitations, and response guidance.Monitor changes to schemas, data sources, APIs, and security platforms that may affect detection or automation reliability.

Security Research and Continuous Improvement

Research emerging attacker techniques, security technologies, and detection opportunities relevant to the organization.Perform threat hunting and controlled attack simulations to validate detection coverage.Identify telemetry gaps and work with technology owners to improve security data quality and visibility.Develop reusable engineering standards, libraries, templates, and frameworks.Review existing alerts and workflows to identify opportunities for tuning, consolidation, or automation.Provide technical guidance on detection logic, telemetry interpretation, and automated workflows.Convert security risks and control gaps into measurable engineering improvements.

Required Experience

4 to 8 years of hands-on cybersecurity experience, with significant exposure to detection engineering, security automation, threat hunting, SOC engineering, or security engineering.Demonstrated experience creating, testing, and tuning production security detections.Strong experience with at least one enterprise SIEM platform and one EDR or XDR platform.Practical scripting or software development experience using Python, PowerShell, or a comparable language.Experience building API-based integrations using REST APIs, webhooks, JSON, and structured security data.Experience with Git, peer review, automated testing, and controlled deployment practices.Strong understanding of endpoint, identity, cloud, network, email, and application security telemetry.Working knowledge of MITRE ATT&CK and common adversary behaviors.Ability to distinguish malicious activity from expected business and system behavior.Ability to convert a security requirement into a tested, maintainable, and measurable engineering solution.