Detection and Threat Engineer

Job Summary

To enhance security monitoring capabilities, the remote Detection and Threat Engineer will develop advanced threat detections, write complex SPL queries, and implement Risk-Based Alerting methodologies while collaborating with various security teams.

Key responsibilities

• Develop and maintain advanced detection content within Splunk Enterprise Security and related security platforms
• Write complex SPL queries to identify threats and suspicious behaviors
• Design and optimize Risk-Based Alerting methodologies to improve detection fidelity

Required qualifications

• 4+ years of experience in Detection Engineering, Threat Detection, or Security Engineering
• Advanced experience writing SPL queries from scratch in Splunk
• Strong hands-on experience with Risk-Based Alerting (RBA) and User and Entity Behavior Analytics (UEBA)
• Knowledge of threat actor tactics, techniques, and procedures (TTPs) and the MITRE ATT&CK framework
• Experience supporting SOC, Incident Response, or Threat Hunting functions