Description

You will design, write, and maintain detection logic across Splunk, Elastic, QRadar, and Sentinel. You engineer behavioral and sequence-based rules to identify sophisticated adversary techniques. You continuously tune detections to reduce noise and improve fidelity against evolving threats. You build production-grade dashboards for analyst triage and incident response. You map detections to MITRE ATT&CK techniques and validate coverage through simulations and incident reviews.

Responsibilities

• Design and maintain detection rules and correlations across SIEM platforms including Splunk, Elastic, QRadar, and Sentinel.
• Engineer detections using behavioral, sequence-based, and threat-informed logic to identify adversary tradecraft.
• Tune detection logic to reduce noise, improve fidelity, and adapt to changing threat landscapes.
• Build and maintain production-grade security dashboards supporting SOC triage and executive decision-making.
• Map detections to MITRE ATT&CK techniques and validate coverage via simulations and incident reviews.

Required Skills

• 5+ years of experience in Detection Engineering, Security Content Development, or Threat Detection.
• Hands-on experience with Splunk, CrowdStrike, Tanium, or Microsoft Defender.
• Deep understanding of security telemetry (endpoint, identity, network, cloud, SaaS) and adversary tradecraft.
• Experience building security dashboards and visualizations for operational SOC or fusion center environments.
• Strong documentation and communication skills to collaborate across teams and operationalize detection strategies.

Key Skills

Education

Any Graduate