[Hiring] Senior Detection Engineer @Intrado Life & Safety, Inc.

Role Description

The modern threat actor moves in seconds or minutes, not days. We are shifting to a detections capability focused on where our data is located (SaaS platforms, automation pipelines, user-controlled data storage) and the knowledge that the future of our perimeter is identity based. As a Detection Engineer, you will not just operate security tools—you will design a high-fidelity system that makes our multi-cloud and on-prem environment inherently hostile to adversaries. This position will be its own customer, building and operating detections, growing from feedback in the field, and iterating. This position will spend (for rough example) 70% on engineering detections for automated attack chains and performing response and triage, with 15% on more traditional log reviews or IOCs, and 15% on strategy and modeling the adversary.

Qualifications

• 5+ years of progressive experience in cybersecurity, including experience in detection engineering, security operations, incident response, threat hunting, security engineering, or a related discipline.
• Background in technical/network security, systems and/or network engineering or cloud computing, with experience in traditional SOC analyst work.
• Minimum 3+ years of experience writing clean automations and scripts in Python, Go, BASH, Helm, or PowerShell.
• Proven experience securing AWS and Azure control planes, specifically auditing IAM, storage access, and cloud log management.
• Strong engineering experience with Kubernetes, including securing cluster control planes and monitoring Kube-audit logs.
• Demonstrated track record of hunting based on identity, behavioral baselines, and Living-off-the-Land (LotL) techniques.
• Hands-on experience engineering automation playbooks, integrations, and orchestration flows specifically within Cortex XSIAM.

Requirements

• Design and implement high-fidelity detection pipelines that detect automated attack chains within minutes or seconds.
• Shift focus from static indicators to complex behavioral analytics and anomaly detection.
• Monitor and protect AWS and Azure infrastructure by tracking API calls, configuration drift, and identity-based movements.
• Dissolve boundaries between external attackers, non-human ID and insider threats.
• Write production-grade Python and automated workflows in other scripting and automation languages/tools.
• Align detection logic with modern matrices like MITRE ATT&CK.
• Deploy deceptive assets, honey-tokens, and behavioral tripwires.
• Deep-dive into application, Kubernetes, and cloud-service APIs.
• Lead analytics and incident response as SME.
• Refine data ingestion pipelines and engineer XSOAR playbooks.
• Ensure that our stack stays positioned for the always-evolving future.

Benefits

• Comprehensive benefits package including medical, dental, vision, life and disability coverage.
• Paid time off and a 401(k) retirement plan.
• Paid parental leave.
• Access to a robust library of personal and professional training resources.
• Employee discounts, critical illness, and hospital indemnity.
• Access to legal support and pet insurance.
• Identity theft protection and an EAP (Employee Assistance Program) that includes free mental health resources/support.