Principal Active Defense Engineer

What you'll do

• Own detection architecture, methodology, quality, and platform design; review complex detections and infrastructure changes.
• Lead initiatives from concept through production and improve reusable detections-as-code, CI/CD, validation tooling, and curated datasets.
• Mentor engineers and partner across security, incident response, threat intelligence, audit, and platform teams; guide appropriate use of AI in detection work.

What they ask for

• 10+ years in software, platform, or security engineering, including significant experience building and operating production-scale detection or security capabilities.
• Experience setting technical direction and leading complex multi-system initiatives as an individual contributor.
• Programming experience in a general-purpose language such as Python, Java, Kotlin, Scala, or JavaScript.
• Experience owning a detections-as-code pipeline, detection platform, or production data pipeline; applying AI to security engineering; and working with SIEM platforms such as Splunk and public cloud environments.

Nice to have

• Experience with automated testing and deployment for detection content, threat-informed detections, adaptive detection analytics, and cross-team technical leadership.
• Relevant certifications or training such as SANS or CISSP are useful but not required.

Pay

$184,800 USD - $277,200 USD (base salary); $167,200 USD - $300,000 USD (base salary)

Tools

Splunk, Spark, Python, Java, Kotlin, Scala, JavaScript, MITRE ATT&CK

AI focus

Determine where agents, automation, generative tooling, and AI-assisted analysis belong in authoring, validating, and tuning detections, including when not to use them.