Description

You will design, write, tune, and maintain detection logic, correlations, and rules across SIEM and detection platforms. You engineer detections using behavioral, sequence-based, and threat-informed logic to identify sophisticated adversary techniques. You continuously tune detections to reduce noise, improve fidelity, and adapt to evolving threat landscapes. You build and maintain production-grade security dashboards that support analyst triage, incident response, and executive decision-making. You map detections and dashboards to MITRE ATT&CK techniques, validating coverage through simulations and real-world incident reviews.

Responsibilities

• Design and maintain detection logic across Splunk, Elastic, QRadar, and Sentinel.
• Engineer detections using behavioral, sequence-based, and threat-informed logic.
• Tune detections to reduce noise, improve fidelity, and adapt to evolving threats.
• Build production-grade security dashboards for analyst triage and executive decision-making.
• Map detections to MITRE ATT&CK techniques and validate coverage via simulations.

Required Skills

• 5+ years of experience in Detection Engineering, Security Content Development, or Threat Detection.
• Hands-on experience with SIEM platforms: Splunk, Elastic, QRadar, or Sentinel.
• Experience with endpoint protection: CrowdStrike, Tanium, or Microsoft Defender.
• Deep understanding of security telemetry (endpoint, identity, network, cloud, SaaS).
• Knowledge of adversary tradecraft and threat detection logic.
• Experience building security dashboards and visualizations for SOC or fusion centers.
• Excellent documentation and communication skills.

Preferred Skills

• Ability to collaborate across teams and operationalize detection strategies.

Key Skills

Education

Any Graduate