Security Engineer, Detection Engineering

Job description

Job responsibilities

• Design, build, test, and tune high-fidelity detection rules and analytic queries across endpoint, cloud, network, identity, and DLP telemetry sources
• Develop and maintain detection content using detection-as-code practices including version-controlled logic, automated testing, and CI/CD deployment
• Map detection coverage to MITRE ATT&CK, identify gaps, and prioritize new detection development based on threat intelligence and business risk
• Engineer correlation rules, behavioral analytics, and anomaly-based detections that minimize false positives while surfacing real adversary tradecraft
• Own the detection lifecycle from initial development through production tuning, performance monitoring, and retirement
• Build and operate pipelines to ingest, normalize, enrich, and manage security telemetry at scale across diverse data sources, using Terraform and infrastructure-as-code practices to deploy and maintain logging and…
• Design and maintain log collection, parsing, and enrichment configurations that ensure the right telemetry is available at the right fidelity for detection and investigation
• Evaluate and onboard new telemetry sources as Saronic's infrastructure and threat landscape evolve

Job requirements

• 3+ years of hands-on experience in detection engineering, security operations, security automation, or a closely related security engineering role
• Demonstrated experience designing, testing, and tuning detection rules and analytic queries across production security telemetry (endpoint, cloud, network, identity, or DLP)
• Hands-on experience with SIEM platforms and proficiency with query languages such as SPL, KQL, or equivalent
• Experience building and operating security data pipelines, including log ingestion, normalization, enrichment, and data quality management
• Understanding of data engineering concepts including ETL pipelines, data modeling, schema design, and indexing as applied to security telemetry
• Hands-on coding experience in Python, PowerShell, Go, or Rust for security automation, detection tooling, or pipeline development, and familiarity with Terraform for managing detection and logging infrastructure as code
• Understanding of MITRE ATT&CK framework and its application to detection coverage and gap analysis
• Ability to obtain and maintain a security clearance