Build, test, and tune threat-informed detection capabilities across enterprise SIEM and data lake platforms. Manage detection-as-code workflows, use AI-assisted tools to validate and optimize rules, investigate false positives, and collaborate with security operations, threat intelligence, threat hunting, and data engineering teams to improve alert fidelity and coverage.
Responsibilities
- Design, build, test, and tune detection rules mapped to MITRE ATT&CK and prioritized by threat intelligence and business risk.
- Write detection logic across SIEM and data lake platforms.
- Manage detection content through Git-based workflows, pull request reviews, and CI/CD deployment pipelines.
- Investigate and systematically suppress false positives using lookup-based architectures.
- Collaborate with Threat Hunting, Threat Intelligence, SOC, and data engineering teams on detection handoffs, alert quality, and telemetry.
- Use AI-assisted workflows to develop and validate rules, analyze coverage, and identify emerging threat behaviors.
Required Skills
- SIEM detection rule development
- Detection analytics and correlation rules
- Detection tuning and false-positive reduction
- Detection-as-code
- Git version control
- CI/CD deployment pipelines
- MITRE ATT&CK mapping
- Threat intelligence analysis
- AI agent and LLM-assisted workflows
- Security telemetry and data lake analysis