Senior Threat Detection Engineer

Role overview

This senior position focuses on building high-fidelity threat detections for industrial control system (ICS) and operational technology (OT) environments. The engineer converts cyber threat intelligence into performant analytics that help customers identify and respond to adversaries targeting critical infrastructure. The work spans atomic, component, and composite detections, with close collaboration across intelligence, engineering, quality, and watch functions in a remote-first, mission-driven environment.

Responsibilities

- Develop ICS-focused threat detections (atomic, component, composite, and event) along with asset identification analytics driven by assigned tickets. - Mentor junior detection engineers by walking them through the detection development process and delegating work they are ready to own. - Support principal engineers through analysis of packet captures and Windows host logs tied to detection initiatives. - Test, validate, and tune detections for analytic quality, including rules submitted by trusted advisors and industry partners. - Triage and respond to detection requests through an internal support board, enriching tickets with PCAPs, links, tags, and documentation. - Drive documentation of processes for authoring, validating, and testing analytics released in platform knowledge packs, and keep the knowledgebase current on reported issues and false positives. - Analyze artifacts collected from ICS equipment, embedded devices, firewalls, network devices, and ICS software, including staging support in an ICS cyber range. - Translate threat intelligence reporting into detection ideation tasks grounded in adversary behavior. - Partner with engineering, watch, and quality teams to close protocol coverage gaps and resolve detection issues. - Participate in regular peer review cycles to give and receive feedback.

Requirements

- 8+ years in security operations, threat hunting, or detection development, OR offensive operations, threat emulation, or security tool development. - 2+ years operationalizing cyber threat intelligence to defend networks from emerging threats. - 1+ years direct experience with SCADA, DCS, building automation, or other industrial control system devices and environments. - Advanced network packet analysis using tools such as Wireshark, Tshark, ngrep, tcpdump, Zeek, and Scapy. - Working knowledge of Windows Event Logging fundamentals, including audit policy configuration and log retention. - Awareness of common operating system internals and the ability to identify analytic opportunities. - Comfort working with multi-gigabyte host and network datasets and applied knowledge of network communication fundamentals. - Demonstrated ability to mentor and develop junior engineers. - Strong verbal presentation and technical writing skills.

Nice to have

- Detection creation experience with Suricata, Snort, YARA, or Zeek. - Prior production of cyber threat intelligence reports or work countering adversary operations. - Software development experience in Python, Rust, Ruby, Go, or Lua. - Familiarity with SOC platforms such as Splunk or Elasticsearch (including ECS). - Incorporating AI tools or models into detection engineering workflows. - ICS network assessments or ICS penetration testing background. - Windows and Linux system administration, networking, firewalls, and virtualization experience. - Relevant certifications such as SANS GICSP, GRID, GCTI, GCIA, GCIH, or GCDA; OSCP, OSEP, or OSED; CompTIA CySA+ or PenTest+. - Willingness to travel up to 10% for internal team activities, conferences, and customer sites.

Benefits and work setup

- Remote-first team distributed across North America, Europe, the Middle East, and APAC. - Base salary of $152,000, competitive equity package, and a comprehensive benefits plan.