Detection Engineer : 26-02750

This role involves designing, building, and fine-tuning security detection rules and automation pipelines to enhance threat detection capabilities. You will collaborate closely with incident response and platform engineering teams to translate investigative needs into effective security logic and streamlined workflows. The position requires a proactive approach to identify and address detection gaps, ensuring efficient alert routing and enrichment for faster incident resolution.

Key Responsibilities:

• Develop and optimize detection rules across SIEM and endpoint security platforms.
• Build automated pipelines for alert enrichment and routing to incident response systems.
• Collaborate with engineers to integrate new detections with existing data pipelines.
• Translate incident response findings into actionable detection logic.
• Support the creation of automated incident response playbooks.

Must-Have Skills:

• Expertise in Splunk SPL and CrowdStrike LogScale/CQL for detection logic.
• Practical experience with API integrations and AWS Lambda for security automation.
• Familiarity with ServiceNow Security Incident Response workflows.

Experience building and maintaining security detections and automation within a Security Operations Center environment is required.