Threat Detection Engineer
S&P Global1 day ago
Hyderābād, IndiaSenior
Responsibilities
- Design, develop, test, and maintain detections for malware, ransomware, identity, insider, cloud, network, AI, and advanced persistent threats.
- Develop detection logic across SIEM, EDR/XDR, cloud, network, identity, and application security platforms.
- Build and maintain security analytics and data pipelines using Python, SQL, Pandas, NumPy, scikit-learn, and Databricks.
- Perform feature engineering, statistical analysis, model development, testing, tuning, and performance monitoring for security use cases.
- Conduct threat hunting and hypothesis-driven investigations to identify detection coverage gaps.
- Map detections to MITRE ATT&CK and improve coverage of priority attack techniques.
- Analyze false positives, false negatives, alert quality, and detection performance.
- Collaborate with SOC, incident response, threat intelligence, SOAR, cloud security, and vulnerability management teams.
- Implement detection-as-code practices with version control, peer review, automated testing, documentation, and controlled deployment.
- Support purple-team exercises, adversary simulations, attack replay, and detection validation.
- Explore Generative AI, Large Language Models, and Agentic AI for threat research, detection development, alert analysis, and investigations.
- Develop Power BI dashboards and reports covering detection coverage, alert trends, model performance, data quality, and operational metrics.
- Document detection logic, data sources, analytical methods, model limitations, investigation procedures, and response recommendations.
Requirements
- Five or more years of experience in cybersecurity, threat detection, detection engineering, threat hunting, security analytics, or a related field.
- Strong knowledge of security operations, incident response, threat intelligence, attack techniques, and enterprise security technologies.
- Hands-on experience developing detections for SIEM, EDR/XDR, cloud, network, identity, or application security platforms.
- Strong Python and SQL skills, including experience processing and analyzing large security datasets.
- Practical experience with data preparation, exploratory analysis, feature engineering, anomaly detection, classification, clustering, model evaluation, and performance tuning.
- Experience with Pandas, NumPy, scikit-learn, Matplotlib, or equivalent tools.
- Experience using Databricks, data lakes, Spark, or other large-scale data processing platforms.
- Experience with detection technologies such as Splunk SPL, Microsoft Sentinel KQL, Elastic, Sigma, YARA, Suricata, Snort, or EDR query languages.
- Understanding of MITRE ATT&CK and the detection engineering lifecycle, including design, development, testing, deployment, tuning, monitoring, and retirement.
- Strong analytical, problem-solving, documentation, and communication skills.
Benefits
- Health care coverage and wellness benefits.
- Generous paid time off and flexible downtime.
- Continuous learning resources and career development opportunities.
- Retirement planning, continuing education support, company-matched student loan contributions, and financial wellness programs.
- Family-friendly benefits and perks.
- Retail discounts and referral incentive awards.