Threat Detection & Response Engineer, True Anomaly

• 3+ years of experience in cybersecurity, with at least 2 years focused on security operations, detection engineering, incident response, or threat hunting
• Experience in building or tuning security detections
• Familiarity with risk-based alerting and alert tuning, including strategies to reduce noise, improve detection fidelity, and prioritize high-signal alerts
• Familiarity with EDR platforms, including basic alert triage and response actions
• Working knowledge of Windows, MacOS, or Linux endpoint security and common attack techniques
• Familiarity with SIEM platforms and log analysis (e.g., Splunk, Elastic, or similar)
• Basic understanding of common attack vectors, TTPs, and security frameworks such as MITRE ATT&CK and the Cyber Kill Chain
• Experience with scripting (Python, PowerShell, or Bash) for automation or analysis tasks
• Clear verbal and written communication skills

Desirable

• As a Threat Detection & Response Engineer III, you will be an integral part of our threat detection and response function, helping build and mature the detection capabilities, response processes, and security tooling that underpin our security operations program
• You'll design and implement detection capabilities, sharpen our incident response procedures, and contribute to the foundation of a world-class security program
• Expect a fast-paced environment where your work carries real weight and directly influences our security posture
• This role is a great fit for someone who takes initiative, enjoys digging into hard problems, and wants to make a tangible impact on a growing security program
• This position requires the ability to obtain and maintain a security clearance
• Develop incident response plans, playbooks, and SOPs; build scalable processes to support future team growth
• Design and implement custom security detections across corporate and cloud environments, leveraging frameworks like MITRE ATT&CK
• Continuously tune detection rules and develop threat models to improve fidelity and address coverage gaps
• Monitor, triage, and respond to security alerts across multiple platforms and data sources
• Perform incident investigations through technical analysis, containment, eradication, and recovery; document findings and lessons learned
• Proactively hunt for threats and leverage threat intelligence to anticipate emerging adversary TTPs
• Administer and optimize EDR and SIEM platforms; integrate log sources to enhance visibility and correlation
• Build automation and orchestration workflows to improve response efficiency
• Partner with cross-functional teams (IT, Engineering, Legal, Compliance) and communicate technical findings to diverse stakeholders