Description

Own the full lifecycle of threat detection engineering, from translating offensive security findings into actionable rules to optimizing detection logic for production environments.

This role is on-site.

Responsibilities

• Develop, validate, and maintain production-grade detection rules across Splunk, CrowdStrike Falcon, and Microsoft Defender.
• Translate penetration test reports and red team assessments into comprehensive detection use cases aligned with MITRE ATT&CK.
• Build correlation-based detections and native platform alerts to ensure broad security coverage and visibility.
• Collaborate with SOC and incident response teams to reduce false positives and improve alert quality.
• Maintain a centralized detection rule repository with version control and document investigation runbooks.

Required Skills

• 5+ years of experience in Detection Engineering, Security Operations, or Threat Detection.
• Hands-on expertise writing and maintaining detection rules for SIEM (Splunk) and EDR platforms.
• Deep understanding of the MITRE ATT&CK Framework and its application to threat detection.
• Proficiency with CrowdStrike Falcon and Microsoft Defender native detection capabilities.
• Experience with Sigma rule authoring and translating detection logic across platforms.
• Ability to validate detections against live telemetry to ensure production readiness.
• Strong analytical skills for identifying detection gaps and recommending monitoring controls.

Preferred Skills

• Scripting experience in Python for automation, log analysis, or tooling development.
• Offensive security certifications such as OSCP, CRTE, or equivalent.
• Familiarity with threat intelligence integration, risk-based alerting, and MITRE ATLAS.

Key Skills

Education

Any Graduate