Senior Threat Detection Engineer

📋 Description

• Design, build, test, and tune detections as code (KQL) through a GitOps workflow: issue, pull
• Map detections to MITRE ATT&CK, find coverage gaps, and decide where to invest next based on
• Review new community and vendor rule releases, such as Sigma, and decide what to adopt, adapt, or
• Cut alert noise by tuning, retiring rules that no longer earn their place, and tracking detection
• Plan and run hypothesis-driven hunts across cloud, SaaS, identity, endpoint, and corporate
• Use adversary emulation to generate test events for detections that have nothing to fire on yet

🎯 Requirements

• 5+ years in security operations, with significant hands-on time in detection engineering, threat
• Experience writing and maintaining detections as code in a modern SIEM
• Strong Python skills and comfort with Git-based workflows, code review, and CI/CD
• Strong in KQL for writing detection queries
• Working knowledge of MITRE ATT&CK and how to use it for coverage analysis, not just labeling
• Experience investigating incidents in cloud (AWS, GCP, and/or Azure), SaaS, and identity providers

🎁 Benefits

• Health, dental, vision, short-term disability, and life insurance
• Paid holidays and paid time off
• Fertility treatment benefit
• 401(k)
• Equity
• Eligible to participate in the Cribl Corporate Bonus Program