Threat Detection Engineer
S&P Global1 day ago
Hyderābād, IndiaSenior
Responsibilities
- Design, develop, test, maintain, and improve detections for malware, ransomware, identity attacks, insider threats, cloud threats, network threats, AI threats, and advanced persistent threats.
- Develop detection logic across SIEM, EDR/XDR, cloud, network, identity, and application security platforms using Splunk SPL, Microsoft Sentinel KQL, Elastic Query DSL, Sigma, and YARA.
- Apply artificial intelligence, machine learning, data science, feature engineering, statistical analysis, and model development to security use cases.
- Build and maintain security analytics and data pipelines using Python, SQL, Pandas, NumPy, scikit-learn, and Databricks.
- Conduct threat hunting and hypothesis-driven investigations to identify detection coverage gaps.
- Map detections to MITRE ATT&CK and analyze false positives, false negatives, alert quality, and detection performance.
- Implement detection-as-code practices involving version control, peer review, automated testing, CI/CD, documentation, and controlled deployment.
- Support purple-team exercises, adversary simulations, attack replay, and detection validation.
- Explore Generative AI, Large Language Models, and Agentic AI for threat research, detection development, alert analysis, and investigations.
- Develop Power BI dashboards and reports covering detection coverage, alert trends, model performance, data quality, and operational metrics.
- Document detection logic, data sources, analytical methods, model limitations, investigation procedures, and response recommendations.
Requirements
- At least five years of experience in cybersecurity, threat detection, detection engineering, threat hunting, security analytics, or a related field.
- Strong knowledge of security operations, incident response, threat intelligence, attack techniques, and enterprise security technologies.
- Hands-on experience developing detections for SIEM, EDR/XDR, cloud, network, identity, or application security platforms.
- Strong Python and SQL skills, including processing and analyzing large security datasets.
- Practical experience with data preparation, exploratory analysis, feature engineering, anomaly detection, classification, clustering, model evaluation, and performance tuning.
- Experience with Python libraries such as Pandas, NumPy, scikit-learn, Matplotlib, or equivalent tools.
- Experience with Databricks, data lakes, Spark, or other large-scale data processing platforms.
- Experience with detection technologies such as Splunk SPL, Microsoft Sentinel KQL, Elastic, Sigma, YARA, Suricata, Snort, or EDR query languages.
- Understanding of MITRE ATT&CK and the detection engineering lifecycle, including design, development, testing, deployment, tuning, monitoring, and retirement.
- Strong analytical, problem-solving, documentation, and communication skills.
Benefits
- Health care coverage for mind and body.
- Generous flexible time off.
- Continuous learning resources and career development opportunities.
- Competitive pay, retirement planning, continuing education support, company-matched student loan contributions, and financial wellness programs.
- Family-oriented benefits and perks for partners and children.
- Retail discounts and referral incentive awards.
- Benefits vary by country; the role is located in Hyderabad, Telangana, India.