Senior Detection Portfolio Engineer
Core
Own an assigned threat actor and partner portfolio end-to-end, translating investigation findings into high-fidelity detections and managing detection lifecycle operations.
Role type
Senior IC detection portfolio engineer (threat intelligence & SOC)
Builds
High-fidelity detections, detection ideas, and automation frameworks for threat actor portfolios
Domain
Cyber security, threat intelligence, Security Operations Center (SOC)
Deliverable
production ML models | product features
Required skills
Kusto (KQL) proficiency, threat actor tradecraft, MITRE ATT&CK mapping, detection logic authoring, query performance tuning, automation/AI tooling (Python, LLMs), signal-to-noise optimization, incident response triage
Preferred skills
Doctorate in Statistics/Math/CS, experience with large-scale computing, ability to make offboarding/deprecation decisions
Technologies
Kusto, Python, Jupyter, Synapse, LLM-based workflows
Responsibilities
Author and gate high-fidelity detections against threat actor portfolios; tune and optimize detection queries for performance and signal quality; lead detection workstream during incidents; manage detection case budgets and coverage-versus-noise tradeoffs; produce leadership-ready updates on detection coverage; collaborate with investigation and hunt leads to translate findings into detection ideas.
Seniority
Senior, hands-on IC
