Senior Detection and Response Engineer, AlphaSense

• 7+ years in security operations with 3+ years in detection engineering, including deep expertise in creating high-fidelity rules (SIGMA, YARA-L, KQL, SPL)
• Proven track record of building detection strategies across SIEM, EDR, and Cloud platforms, grounded in the MITRE ATT&CK framework
• Expert knowledge of SOAR platforms (e.g., Tines, Splunk SOAR, Cortex XSOAR), architecture, and complex playbook development
• Proven experience designing and implementing SOAR platform architecture from concept to production
• Advanced scripting and automation development skills in Python (required) for API integrations and security tool orchestration
• Strong background in threat hunting methodology, hypothesis development, and campaign execution, with experience leading or co-leading hunting programs
• Proficiency with data analysis, anomaly detection, and hands-on experience with hunting tools like Jupyter Notebooks, Osquery, and Velociraptor
• Deep understanding of attack techniques, lateral movement, persistence mechanisms, and post-exploitation TTPs across Windows, Linux, and macOS
• Familiarity with security frameworks including MITRE ATT&CK, PICERL, NIST CSF, and Detection Maturity Models, and incident response best practices
• Proven ability to lead technical initiatives, mentor team members, and communicate complex technical concepts to diverse audiences

Desirable

• The Senior Detection and Response Engineer is a critical technical role responsible for driving the organization's defensive security capabilities across detection engineering, security orchestration, automation, and response (SOAR), and co-leading the organization's threat hunting program
• This role is crucial for integrating new threat intelligence into high-fidelity detections and automating incident response processes to maximize team efficiency and response speed
• You'll work directly with the Director of Security Monitoring, Detection and Response and collaborate closely with the SOC Manager to co-lead threat hunting initiatives, while partnering with cross-functional security teams to build and scale our security operations capabilities
• You'll be joining a fast-paced security organization that emphasizes automation, engineering-driven approaches, and systematic problem-solving
• Our team operates at the intersection of security operations, detection engineering, incident response, and infrastructure security
• We value practical solutions, measurable outcomes, and continuous improvement
• 1. Detection Engineering & Platform Leadership (40%)
• Design, implement, and maintain advanced detection rules and correlation logic across SIEM , EDR, and Cloud platforms (AWS, GCP)
• Lead detection strategy and architecture aligned with the Detection Quality frameworks
• Write high-fidelity detection rules using languages like SIGMA and YARA-L
• Conduct deep log source analysis, perform threat modeling, adversary emulation, and maintain MITRE ATT&CK mapping coverage
• Conduct detection gap analysis to identify coverage opportunities across the kill chain
• Create and maintain detection playbooks, runbooks, and comprehensive documentation
• Perform detection quality assessments and continuous improvement initiatives
• 2. Security Automation (SOAR) & Response Leadership (40%)
• Develop complex automated response playbooks for multi-stage incidents spanning multiple security tools
• Integrate security tools via APIs (SIEM, EDR, MDM, CASB, ITSM, threat intelligence platforms)
• Create automated enrichment pipelines incorporating threat intelligence, asset context, and user behavior analytics
• Develop automated containment actions (account disable, host isolation, firewall rule updates)
• Measure and report automation ROI, tracking metrics like time saved and incident handling efficiency
• Handle Incident Response processes and procedures as needed
• 3. Threat Hunting Co-Leadership & Execution (20%)
• Co-lead the organization's threat hunting program with the SOC Manager, defining strategy, methodology, and campaign planning
• Execute proactive threat hunting campaigns by conducting hunt queries across SIEM and EDR platforms
• Analyze large datasets to identify anomalous behavior patterns including user behavior, process execution, network traffic, and cloud activity
• Develop hunting automation and tooling using custom Python scripts, Jupyter Notebooks, Osquery, and Velociraptor
• Collaborate with threat intelligence sources to incorporate latest TTPs into hunting campaigns
• High-Impact Leadership Role: Own critical security capabilities (detection, automation, hunting) with direct organizational impact
• Greenfield Opportunities: Architect and build SOAR platform from the ground up and lead major SIEM migration efforts
• Technical Depth: Solve complex problems at scale with Modern security stack
• Scale & Complexity: Protect a critical platform serving enterprise customers with sophisticated threats
• Autonomy & Influence: Shape security architecture decisions, tool evaluations, and team direction
• Growing Team: Join a growing team with clear structure, specialized roles, and growth trajectory
• Balance & Variety: Split time between strategic architecture (detection, SOAR) and hands-on execution (hunting, investigation)
• Innovation Culture: Implement detection-as-code, automation-as-code, and data-driven security practices