[Hiring] Senior Threat Engineer @CDW

Role Description

The Senior Threat Engineer is a hands-on, high-impact role within the Enterprise Defense & Automation (EDA) team. You will engineer AI-powered detection and response capabilities that compress attacker dwell time from days to minutes, continuously red teaming those defenses at attacker speed.

• Build detections and AI-assisted response paths that triage, decide, and act autonomously within policy.
• Run continuous, automated adversary emulation against production controls.
• Write detection logic, adversary emulation content, and automated response playbooks.
• Instrument measurable outcomes such as mean time to detect, mean time to contain, and detection coverage against MITRE ATT&CK.
• Use AI to raise signal fidelity rather than alert volume.

Qualifications

• Bachelor’s degree and 7+ years of experience in threat detection engineering, threat hunting, incident response, or offensive security, or 11+ years of equivalent experience.
• Hands-on experience building and tuning detections in SIEM platforms and cloud-scale security tooling.
• Practical working knowledge of the MITRE ATT&CK framework.
• Experience with adversary emulation, purple teaming, breach and attack simulation, or penetration testing.
• Proficiency in Python for production-grade automation and tooling.
• Experience applying AI/ML or LLM-based capabilities to security problems.
• Working experience with security automation, orchestration, or SOAR platforms.
• Built detection and response capability for large, diverse enterprise environments, a plus.
• Familiarity with platforms such as Microsoft Defender, Microsoft Sentinel, CrowdStrike, Tines, Entra ID, and Splunk, a plus.
• Familiarity with emulation and offensive tooling such as Atomic Red Team, Caldera, Cobalt Strike, or commercial breach and attack simulation platforms, a plus.
• Detection-as-code practice: CI/CD pipelines, infrastructure-as-code, policy-as-code, and automated testing of detection content, a plus.
• Experience securing or red teaming AI systems, including prompt injection, model evasion, and agent safety testing, a plus.
• Relevant certifications (GCIH, GCFA, GCTI, GPEN, OSCP, Azure Security, or cloud and automation certifications), a plus.

Requirements

• Engineer high-fidelity detections across identity, endpoint, network, cloud, and SaaS.
• Apply AI and machine learning to triage, correlate, and enrich alerts.
• Build autonomous and semi-autonomous response playbooks.
• Implement guardrails for safe autonomy.
• Instrument detection and response for measurable outcomes.
• Use LLMs and agentic tooling effectively.
• Stand up and operate continuous, automated adversary emulation.
• Use AI to generate and mutate attack behavior.
• Close the loop from emulation to engineering.
• Red team AI detection models and agents.
• Operate emulation safely in production.
• Report coverage as a living metric.
• Track adversary tradecraft and translate intelligence into actionable plans.
• Run hypothesis-driven threat hunts and convert confirmed techniques into automated detections.
• Lead technical deep dives on incidents and findings.
• Treat detection content as software: version controlled and peer reviewed.
• Develop integrations and tooling in Python.
• Build self-healing detection and response capability.
• Eliminate repeat findings through auto-remediation patterns.
• Partner closely with various teams for clear ownership of actions.
• Document detection logic, emulation plans, and engineering decisions.

Benefits

• Pay range: $137,000 – 190,600 depending on experience and skill set.
• Annual bonus target 10% subject to terms and conditions of plan.
• Benefits overview: https://cdw.benefit-info.com/
• Salary ranges may be subject to geographic differentials.