- Company Name
- CLEAR
- Job Title
- Threat Detections Engineer II
- Job Description
-
Job Title: Threat Detection Engineer II
Role Summary:
Design, develop, and optimize detection logic to identify malicious or anomalous activity across diverse data sources, turning threat intelligence into actionable security measures. Drive automation across the detection lifecycle and collaborate with security functions to improve overall signal fidelity and response effectiveness.
Expectations:
- Translate threat intelligence, incident learnings, and emerging trends into high‑impact detection rules.
- Partner with Threat Intelligence, Incident Response, Automation, and other security teams to operationalize new detections and refine response strategies.
- Continuously evaluate detection performance by analyzing false positives, coverage gaps, and asset visibility.
- Support and expand automation through development, validation, deployment, and maintenance of detection workflows.
- Document detection logic, workflows, and data sources for repeatability and scalability.
- Map detection coverage to frameworks such as MITRE ATT&CK and reduce measurable gaps over time.
Key Responsibilities:
- Design, implement, and tune custom detections in SIEM or cloud‑native environments.
- Analyze network, endpoint, identity, and cloud telemetry to uncover meaningful signals amid noisy data.
- Write clear, scalable detection logic using rule languages, scripting, automation frameworks, and Detection‑as‑Code practices.
- Collaborate across security functions, communicating effectively to align detection outcomes with broader defense objectives.
- Test and refine small improvements in tooling, process, and automation to drive program maturity.
- Utilize tools such as Google Chronicle, YARA/YARA‑L, BigQuery, SOAR platforms, and Python.
- Map detection coverage to MITRE ATT&CK and contribute to reducing gaps.
Required Skills:
- 3–5 years of experience in security operations or detection engineering.
- Proven ability to build, tune, and validate detections in SIEM or cloud‑native platforms.
- Strong grasp of networking, identity, endpoint telemetry, and modern attack techniques.
- Advanced pattern‑recognition across multi‑vector data sources.
- Scripting proficiency (Python preferred) and experience with rule languages/automation frameworks.
- Familiarity with MITRE ATT&CK, Sigma, and detection‑as‑code concepts.
- Experience with tools: Google Chronicle, YARA/YARA‑L, BigQuery, SOAR platforms.
- Excellent communication, collaboration, and analytical skills.
Required Education & Certifications:
- Bachelor’s degree in Computer Science, Information Security, or related field preferred (or equivalent experience).
- Relevant certifications (e.g., CISSP, Security+) are beneficial but not mandatory.