Senior Threat Detection Engineer - Intelligence

The role

This IC role sits within the Cloud Security, Detection and Response team, which turns outside threat research into working detections for cloud and SaaS systems. The engineer builds high-signal detections, leads complex investigations, and serves as technical lead during live security incidents.

What you would do

• Monitor newly emerging attacker methods and active campaigns affecting cloud and SaaS platforms
• Convert intelligence findings into detection plans and testable attack hypotheses
• Build and upkeep context-aware detections spanning cloud, identity, and application layers
• Drive investigations from initial alert through root cause and fix
• Guide technical response decisions during security incidents
• Study detection and investigation patterns to strengthen preventive controls
• Work with engineering teams to improve security maturity

What they asked for

• Five to seven years of security experience, including at least two in detection, threat intel, or investigations
• Background in cloud-native SaaS environments, AWS preferred
• Strong ability to investigate and reason about adversary behavior
• Hands-on use of threat intelligence to shape detection and response
• Proficient in Python and automating security tasks
• Experience querying large datasets with SQL or similar
• Familiarity with cloud telemetry, logging, and detection platforms
• Working knowledge of incident response and digital forensics
• Experience with infrastructure-as-code tooling such as Terraform