Detection & Automation Engineer
Core
Design, build, test, and maintain advanced threat detections across security platforms and data sources to strengthen security visibility and threat response.
Role type
Senior IC detection and automation engineer
Builds
Advanced threat detections, security monitoring frameworks, dashboards, and automated response capabilities
Domain
Cybersecurity, SIEM engineering, cloud security, and enterprise infrastructure
Required skills
Threat detection engineering, SIEM administration (Splunk), log management, telemetry engineering, cloud security, identity security, endpoint security, database security, MITRE ATT&CK frameworks, data normalization, scripting (Python/PowerShell), CI/CD pipelines, source control, automated testing, troubleshooting, analytical problem-solving
Preferred skills
Splunk Enterprise, Cribl Stream, regulated environment monitoring, database administration, enterprise data engineering, large-scale telemetry architectures, Detection-as-Code, audit logging standards, security observability, relevant certifications (Splunk Core, GIAC, CISSP, GCIA, GCIH)
Technologies
Splunk, Python, PowerShell, CI/CD, Cloud platforms
Responsibilities
Design, build, test, and maintain advanced threat detections; Administer and optimize Splunk Enterprise Security frameworks, data models, reports, and dashboards; Troubleshoot security data ingestion, extraction, parsing, normalization, and performance issues; Collaborate with technology teams to onboard security data sources and verify telemetry quality; Establish and maintain security logging standards, monitoring controls, and data quality processes; Develop monitoring for enterprise databases and critical applications; Support Detection-as-Code through version control, automated testing, and reusable frameworks; Reduce false positives and improve detection accuracy; Provide technical leadership and mentor junior engineers
