Threat Detection Engineer - TX, MN, AZ, NC

Information Security Engineer 4 – Threat Detection Engineer (Contingent)

This senior Information Security Engineering role focuses on Threat Detection Engineering for large-scale, multi-cloud enterprise environments. The engineer will design, build, tune, and validate detections across SIEM, EDR/XDR, cloud platforms, and identity systems. The role requires advanced threat understanding, strong detection lifecycle ownership, and high-fidelity detection development aligned with MITRE ATT&CK.

The engineer will partner with SOC, IR, logging/telemetry teams, cloud security, and platform engineering to strengthen threat visibility, reduce noise, and drive high-quality, actionable detection content. Automation, structured engineering processes, and an attacker-mindset approach are essential to success.

Top requirements include:

1. 5+ years Information Security Engineering / Threat Detection Engineering / SOC / Incident Response experience, with 3+ years writing & tuning detections.
2. Ownership of full detection lifecycle: requirements → design → build → tuning → validation → decommission.
3. Hands-on experience with Splunk (SPL), CrowdStrike (custom IOA), Microsoft Defender, Sentinel (KQL).
4. Experience detecting threats across Azure + GCP cloud environments.
5. Strong understanding of MITRE ATT&CK, adversary TTPs, and detection gap analysis.

Plusses include:

1. Experience with AIOps, adversary simulation tools (Atomic Red Team, Caldera, BAS platforms).
2. Strong automation skills (Python / PowerShell) for detection pipelines.
3. Experience in multi-tenant, multi-cloud, global enterprises.
4. Experience building detection dashboards, runbooks, feedback loops with SOC.
5. Experience with large datasets, log telemetry engineering, and cloud-native security controls.

Day-to-day responsibilities include:

• Develop and tune detections across Splunk, CrowdStrike, Microsoft Defender, Sentinel (KQL).
• Interpret attacker TTPs and convert them into detection logic across SIEM, EDR, and cloud telemetry.
• Perform detection gap assessments and prioritize detections tied to emerging threats.
• Map detections to MITRE ATT&CK ensure enterprise TTP coverage.
• Track evolving threats (phishing, ransomware, cloud account compromise, identity abuse).
• Operationalize threat intelligence into actionable detections.
• Measure and improve signal fidelity (precision/recall).
• Conduct false-positive/negative analysis and refine rules.
• Use adversary simulation tools (Atomic Red Team, Caldera, BAS) to validate coverage.
• Maintain detection dashboards, metrics, and SOC feedback loops.
• Assess log quality and coverage across Windows, Sysmon, Linux, network telemetry, identity, cloud-native logs.
• Define requirements for new logs; work with infra teams to onboard/normalize sources.
• Use Python or PowerShell to automate detection testing, deployment, and reporting.
• Manage detection content through SDLC-like processes: Git, pull requests, staged releases.
• Support infrastructure-as-code patterns for security controls (nice-to-have).

EEO Employer

Apex Systems is an equal opportunity employer. We do not discriminate or allow discrimination on the basis of race, color, religion, creed, sex (including pregnancy, childbirth, breastfeeding, or related medical conditions), age, sexual orientation, gender identity, national origin, ancestry, citizenship, genetic information, registered domestic partner status, marital status, disability, status as a crime victim, protected veteran status, political affiliation, union membership, or any other characteristic protected by law. Apex will consider qualified applicants with criminal histories in a manner consistent with the requirements of applicable law. If you have visited our website in search of information on employment opportunities or to apply for a position, and you require an accommodation in using our website for a search or application, please contact our Employee Services Department.