🛠 Tech Stack

💼 About This Role

You'll lead detection content development within the SIEM platform for a Managed Security team, creating and tuning rules to improve threat coverage. Your work will directly reduce false positives and enhance incident response workflows. You'll also partner with clients to align detections with their risk profiles.

🎯 What You'll Do

• Lead detection content development in Elastic, Palo XSIAM, or Crowdstrike
• Manage health and performance of detection content
• Design dashboards and visualizations for triage and hunting
• Collaborate on SOAR workflow integration with Swimlane

📋 Requirements

• Experience with Elastic Security core components (Elasticsearch, Logstash, Kibana)
• Strong SIEM administration with detection use cases and correlation logic
• Scripting in Python or similar for automation of detection tasks
• 2–4 years of experience in Security Detection Engineering

✨ Nice to Have

• Incident handling/response experience
• Certifications: CISSP, GCIA, GCIH, GPYC, GMON, GCDA, Elastic Certified Engineer
• Knowledge of common security technologies (IDS, Firewall, EDR)

🎁 Benefits & Perks

• 🏖️ Remote work flexibility
• 🏥 Health insurance coverage
• 💰 Competitive salary (120k-150k USD)

📨 Hiring Process

Estimated timeline: 2-4 weeks · AI estimate

1. 1Recruiter Screen· 30 min
2. 2Technical Interview· 60 min
3. 3Client Interview· 45 min