Security Detection Engineer III

The Security Engineer III Detection Engineering is a career-level security engineering professional responsible for developing testing deploying and continuously improving detection capabilities that support Security Operations. As part of the Security Operations Platform Engineering (SOPE) team this role focuses on transforming threat intelligence telemetry and security requirements into reliable actionable detections that improve visibility and reduce organizational risk. The engineer partners closely with Incident Response Threat Intelligence Logging Engineering and platform engineering teams to build scalable threat-driven detection capabilities while advancing automation detection coverage and operational maturity.

Primary Responsibilities

• Develop andmaintaincustom detections using Detection-as-Code practices including version control peer review testing and CI/CD deployment workflows.

• Analyze and improvedetection coverage by mapping telemetry and detections to adversary behaviors and the MITRE ATT&CK frameworkidentifyinggaps and prioritizing enhancements.

• Partner withIncident Response Threat Intelligence Logging Engineering and security platform teams to translate emerging threats investigations and telemetry into actionable detection content.

• Validate and tunedetections through adversary emulation atomic testing purple-team exercises and production feedback to improve signal quality and reduce false positives.

• Automate andoptimizedetectionengineering workflows alert enrichment processes and operational activities to improve efficiency and scalability.

• Supportonboardingofnew log sources and security telemetry by collaborating with engineering and infrastructure teams toestablishdetection coverage across new environments and technologies.

• Create andmaintaindetectiondocumentation runbooks coverage assessments and technical standards whileparticipatingin an engineering on-call rotation.

• Help define detection strategy for AI and agentic systems (prompt injection tool and function abuse agent identity and credential misuse data exfiltration via model outputs) andexplore using AI to accelerate detection engineering workflows.

Required Skills / Qualifications

• Bachelors degree in Information Security Computer Science Engineering or related field or equivalent practical experience.

• 5 years of experience in cybersecurity security engineering detection engineering security operations threat hunting ora relateddiscipline.

• Experience developing tuning ormaintainingdetections within a SIEM EDR log analytics or security monitoring platform.

• Experience with scripting automation or data analysis using Python PowerShell SQL KQL SPL or similar technologies.

• Strong understanding of attacker techniques detection methodologies and frameworks such as MITRE ATT&CK.

• Strong analytical problem-solving communication and cross-functional collaboration skills.

Preferred Skills / Qualifications

• Experience implementing Detection-as-Code practices including Git-based workflows automated testing and CI/CD pipelines.

• Experiencewith adversary emulation atomic testing purple-team exercises or detection validation frameworks.

• Experience performing detection coverage analysis and developing ATT&CK-based coverage roadmaps.

• Experience onboarding log sources and building detections across cloud endpoint network identity or SaaS environments.

• Experience with platforms such as CrowdStrike Splunk Microsoft Sentinel Chronicle Elastic or similar security technologies.

• Familiarity with AI/LLM threat models (prompt injection tool and function abuse agent identity and credential misuse data exfiltration via model outputs) or frameworks such as MITRE ATLAS and the OWASP LLM Top 10 and interest in applying AI to accelerate detection engineering workflows.

Work Environment

This is a full-time engineering role and is not a shift-based position.Participation in an engineering on-call rotation isand may occasionally require support outside normal business hours during critical incidents platform outages or detection-related operational events. The Security Engineer III may be engaged as a subject matter expert during security incidents but is not responsible for primary incident response or SOC operations. Travel may beup to 5% including occasional international travel.

#LI-SS5