Senior Threat Engineer – AI-Powered Detection, Response & Continuous AI Red Teaming
CDW Corporation2 months ago
Remote, United StatesSenior
Base Salary
$137k - $191k/yr
Responsibilities
- Engineer high-fidelity detections and automated response paths across identity, endpoint, network, cloud, and SaaS environments.
- Apply AI, machine learning, LLMs, and agentic tooling to alert triage, correlation, investigation summarization, indicator extraction, and response recommendations.
- Build autonomous and semi-autonomous playbooks for host isolation, session and token revocation, credential disabling, infrastructure blocking, and content quarantine.
- Implement confidence thresholds, blast-radius controls, human-in-the-loop escalation, rollback paths, rate limits, abort criteria, and audit trails for safe automation.
- Operate continuous automated adversary emulation against production controls and use AI to mutate attack behavior across MITRE ATT&CK techniques.
- Red team detection models, agents, and prompts for evasion, prompt injection, data poisoning, and unsafe autonomous actions.
- Run threat hunts across SIEM, XDR, identity, and cloud telemetry and translate findings into reusable detections and automated responses.
- Develop version-controlled, peer-reviewed, unit-tested detection content and Python integrations through security-gated delivery pipelines.
- Build self-healing detection and response capabilities that identify telemetry gaps, sensor degradation, and control drift and remediate or roll back issues.
- Lead technical deep dives, document detection and emulation practices, collaborate with security teams and platform owners, and mentor engineers and analysts.
Requirements
- Bachelor’s degree and 7+ years of experience in threat detection engineering, threat hunting, incident response, or offensive security, or 11+ years of equivalent experience.
- Hands-on experience building and tuning detections in SIEM platforms and cloud-scale security tooling.
- Practical knowledge of MITRE ATT&CK and experience mapping detections and automated responses to its techniques.
- Experience with adversary emulation, purple teaming, breach and attack simulation, or penetration testing against production controls.
- Proficiency in Python for production-grade automation and tooling.
- Experience applying AI/ML or LLM capabilities to security problems and designing secure, observable, maintainable AI-enabled solutions.
- Experience with security automation, orchestration, or SOAR platforms.
- Familiarity with Microsoft Defender, Microsoft Sentinel, CrowdStrike, Tines, Entra ID, and Splunk.
- Familiarity with Atomic Red Team, Caldera, Cobalt Strike, or commercial breach and attack simulation platforms.
- Detection-as-code experience including CI/CD pipelines, infrastructure-as-code, policy-as-code, and automated testing of detection content.
- Experience securing or red teaming AI systems, including prompt injection, model evasion, and agent safety testing.
- Relevant certifications such as GCIH, GCFA, GCTI, GPEN, OSCP, Azure Security, or cloud and automation certifications are a plus.
Benefits
- Benefits information is provided at https://cdw.benefit-info.com/.
- The salary range may vary based on geographic differentials.
- CDW describes a collaborative, equitable, transparent, and respectful work environment with support for employee growth and learning.
About CDW Corporation
CDW Corporation is an IT solutions provider and reseller that designs, supplies, and manages hardware, software, cloud, and cybersecurity for businesses, government, education, and healthcare. Its model combines product resale from major vendors with consulting, managed services, and lifecycle support across data center, networking, and end‑user computing. Founded in 1984 and headquartered in Vernon Hills, Illinois, CDW is publicly traded on NASDAQ.