[Hiring] Senior Threat Engineer @Coalition, Inc.

Role Description

A Senior Threat Engineer builds and improves systems, logic, and workflows that allow Coalition’s Wirespeed Verdict Engine to make high-precision security decisions at scale. This is not a traditional SOC analyst role. Success in this position is defined by handling thousands of similar situations better, faster, and more consistently through automation, patterning, and engineering.

• Study how investigations should work and identify repeatable decision points.
• Turn investigative thinking into detections, enrichment, triage logic, and automated response workflows.
• Take ownership of complex problem areas and exercise strong judgment in ambiguous situations.
• Bridge threat detection, engineering, and customer experience.
• Design systems that scale expert judgment, improving customer outcomes and operational efficiency.

Responsibilities

• Design, build, and improve the detection, decisioning, and response workflows that power the Wirespeed Verdict Engine.
• Own complex threat detection and workflow problem spaces from investigation concept through implementation, validation, and iteration.
• Translate investigative thinking and threat research into scalable detections, enrichment, triage logic, and automated decisions.
• Analyze operational data to identify false positives, false negatives, latency issues, and opportunities for improvement.
• Continuously raise the ceiling of what the system can do autonomously.
• Support complex or novel cases and feed lessons back into the system.
• Ensure Wirespeed outputs are clear, helpful, accurate, and appropriately calibrated to the customer’s situation.
• Identify patterns in customer pain, confusion, or friction to improve verdict logic and overall product behavior.
• Partner closely with product, engineering, and security teams to improve platform capabilities.
• Help define best practices, operating principles, and technical standards for Threat Engineering work.
• Document detection concepts, workflow logic, and operating principles.
• Provide technical leadership through strong execution, sound judgment, and mentorship.

Qualifications

• Significant experience in cybersecurity operations such as threat detection and response, detection engineering, incident response, threat hunting, or SOC operations.
• Ability to look for repeatable patterns and ways to scale good judgment through automation.
• Strong investigative and analytical skills.
• Experience building, tuning, or maintaining automations, detections, playbooks, rules, or enrichment pipelines.
• Demonstrated ability to independently own complex technical or operational problem areas.
• Interest in improving how work gets done rather than only executing it.
• Strong written and verbal communication skills.
• Comfort using data to evaluate detection quality and workflow performance.
• Preference for simple, scalable solutions.

Bonus Points

• Experience working in a high-volume security operations environment.
• Significant experience with detection and response tooling such as SIEM, EDR, SOAR, case management, and telemetry enrichment systems.
• Familiarity writing scripts or queries to support investigations, automation, or workflow analysis.
• Experience improving operational quality through experimentation and continuous iteration.
• Experience in workflow design, detection engineering, automation, or security product development.
• Experience mentoring fellow engineers and influencing team approaches.

Benefits

• 100% medical coverage, including outpatient care.
• Life insurance.
• 25+ paid holidays.
• Annual home office stipend.
• 7% employer pension contribution.
• Mental and physical health wellness programs like Headspace, Wellhub.
• Competitive compensation and opportunity for advancement.