Strada

Detection Engineer - Remote

Strada

full-time

Posted on:

Origin:  • 🇺🇸 United States • California, New York

Visit company website
✨ AI Apply
Manual Apply

Job Level

Mid-LevelSenior

Tech Stack

AzureCloudCyber SecurityGoogle Cloud PlatformPythonServiceNowSplunk

About the role

  • Develop and maintain advanced threat detection logic using SIEM, EDR/XDR tools, and other security monitoring platforms
  • Supplement vendor-provided detections for common attacks in XDR and SIEM tools
  • Conduct threat modeling exercises to identify critical detection gaps and build targeted detection scenarios aligned with attacker techniques
  • Perform regular validation and tuning of detection rules through purple team exercises, adversary simulations, and red team engagements
  • Develop and maintain automation playbooks and scripts (Python, PowerShell, etc.) to streamline security operations and reduce false positives
  • Work closely with analysts to refine alert fidelity, ensuring meaningful, actionable detections
  • Identify gaps in security telemetry and collaborate with engineering teams to onboard and optimize new data sources for enhanced visibility
  • Stay abreast of emerging threats, trends, and detection methodologies to continuously evolve the organization’s security monitoring capabilities

Requirements

  • Minimum of 3 years of experience in a detection engineering or related cybersecurity role
  • Deep technical expertise with SIEM platforms (e.g., Splunk, Microsoft Sentinel, Elastic Security, QRadar)
  • Hands-on experience with SIEM and EDR/XDR tools (Microsoft Sentinel, CrowdStrike, etc.)
  • Strong understanding of cyber threat frameworks and attack patterns (MITRE ATT&CK, Cyber Kill Chain)
  • Experience writing and refining detection logic using query languages (e.g., KQL, etc.)
  • Experience with integrating automation for ticketing tools (e.g., ServiceNow, SIEM), etc.
  • Familiarity with cloud security and associated log sources (Azure Sentinel, GCP logging)
  • Strong communication and collaboration abilities
  • Relevant certifications such as GCDA, GCIA, Microsoft Sentinel Security certifications, or equivalent are a plus