What You'll Be Doing
Determine the methods, techniques, and evaluation criteria for new detection assignments, balancing telemetry coverage, attacker behavior, alert volume, and operational cost
Drive the insider risk and DLP detection project, extending the building block approach across multiple log sources as you help build user risk ranking
Own committed detections through production readiness by confirming target behavior, selecting supporting telemetry, testing detection logic, documenting expected false positives, and providing response guidance for Incident Response and Insider Threat teams
Tune existing detection content using investigator feedback, alert volume, and precision metrics to improve the quality and actionability of alerts
Use MITRE ATT&CK and the current threat landscape to identify coverage gaps and prioritize detections that address meaningful risks
Evaluate and apply AI assisted workflows where they can improve detection development, enrichment, or triage, validating results before operational use
Coach detection engineers earlier in their careers on design decisions, testing discipline, tuning strategy, and production readiness
The Impact You Will Have
More actionable insider risk and DLP alerts, giving Incident Response and Insider Threat investigators clearer signals to review while reducing effort spent on low value results
A repeatable detection lifecycle built on shared methods, consistent evaluation criteria, and reusable components rather than isolated rules
Stronger design and tuning decisions across the team as developing detection engineers apply consistent production readiness standards
Shorter development and investigation cycles through validated AI assisted workflows for detection development, enrichment, and triage
A detection library designed around available telemetry, real operational conditions, and the needs of the teams responding to alerts
Clearer alignment between detection engineering and program stakeholders when available telemetry can't support a request, including agreement on what is feasible and what additional data would be required
What You'll Need
Bachelor's degree and a minimum of 6 years of related experience, or an advanced degree and a minimum of 5 years of related experience in detection engineering, security operations, red teaming, insider threat, or incident response, with substantial experience building detection content
Experience building detection content in an enterprise SIEM. Elastic experience is strongly preferred
Experience working with security telemetry from EDR, firewalls, IDS/IPS, cloud platforms, DLP, or similar enterprise sources
Experience applying incident response, investigation, or security operations knowledge to detection design. Experience supporting insider threat or DLP programs is highly relevant, but deep detection engineering expertise is the primary requirement
Working knowledge of MITRE ATT&CK and its application to detection design
Proficiency in Python or another relevant programming language, with familiarity with Detection as Code, CI/CD, and security automation
Who You Are
Comfortable making sound technical decisions on complex or unfamiliar problems with limited supervision, selecting an appropriate approach and evaluation criteria without requiring a detailed specification
Precise about what a log source can support and able to align partner teams on what is feasible when available telemetry cannot meet a request
Focused on outcomes, building detections that hold up once real alerts start firing and provide investigators with actionable signals
Comfortable leading a deep body of work, starting with insider risk and DLP telemetry before moving to the next committed priority
Generous with technical judgment and feedback, helping other engineers improve how they design, test, and tune detections
Pragmatic about AI, identifying workflows where it can add value while validating results before operational use
The Team You'll Be Part Of
You will report to the Senior Manager of Cyber Security Engineering, based in Austin, Texas. The team is distributed across multiple countries, including colleagues in Greece, and operates in a global environment. The detections you build will feed directly into Incident Response and Insider Threat teams, so you will work closely with investigators who depend on your content to surface actionable signals.
Rewards and Benefits
We offer a comprehensive range of health, wellness, and financial benefits to cater to your needs. Our total rewards include both monetary and non-monetary offerings. Your recruiter will provide more details about the salary range and benefits during the hiring process.
#LI-Hybrid
