Threat Detection Engineer (Cloud Security)

What you'll do

• Build, test, and maintain detection rules for cloud, container, and host activity; analyze AWS and on-prem telemetry.
• Hunt for malicious activity and improve alert fidelity through analysis of false positives and negatives.
• Develop automated response playbooks and use AI/ML to support query generation, threat intelligence correlation, and detection development.

What they ask for

• At least 4 years of relevant experience, including 2+ years authoring and tuning detection logic in Splunk Enterprise and the ELK Stack.
• Experience applying DoD cybersecurity requirements and responding to incidents in a vSOC, SOC, or CSSP; direct AWS GovCloud telemetry experience.
• Experience using GitLab for Detection-as-Code, CI/CD, version control, and DevSecOps workflows.
• Required DoDD 8140 IAT CSSP certification before hire; bachelor’s degree in a related field; U.S. citizenship and active Top Secret/SCI clearance.

Nice to have

• Experience with Terraform or CloudFormation; familiarity with container security and Kubernetes threat modeling.
• Experience with RHEL, post-incident computer forensics, or advising on DoD cyber regulations.

Pay

$100,000.00 - $160,000.00 USD base salary

Tools

Splunk Enterprise, ELK Stack (Elasticsearch, Logstash, Kibana), AWS GovCloud, GitLab, Terraform, CloudFormation, Falco, RHEL

AI focus

Uses AI-assisted analysis and ML features to improve query generation, threat intelligence correlation, detection development, and incident response.