Cyber Defense Engineer (Detection Engineering & Threat Monitoring)

Must Have Technical/Functional Skills

• Strong experience with Detection Engineering and use case development.
• Hands-on experience with SIEM platforms such as Splunk, Microsoft Sentinel, QRadar, or Elastic.
• Experience creating and tuning correlation rules, analytics, alerts, and dashboards.
• Strong knowledge of Threat Modeling methodologies and attack path analysis.
• Experience with Threat Hunting and proactive threat identification.
• Hands-on experience with EDR/XDR solutions such as CrowdStrike, Microsoft Defender, Sentinel One, or Carbon Black.
• Strong understanding of the MITRE ATT&CK Framework and adversary TTPs.
• Experience analyzing security logs from endpoints, networks, cloud platforms, and identity systems.
• Proficiency in one or more of the following: KQL, SPL, Python, PowerShell, SQL.
• Experience with incident investigation and security monitoring.

Roles & Responsibilities

• Design, develop, and optimize threat detection use cases and security analytics.
• Build and maintain detection rules, correlation searches, dashboards, and alerting mechanisms across security platforms.
• Develop detection content based on threat intelligence, attack frameworks, and emerging threats.
• Conduct threat modeling exercises to identify attack paths, security gaps, and mitigation strategies.
• Perform proactive threat hunting and security monitoring across enterprise environments.
• Collaborate with SOC, Incident Response, Threat Intelligence, and Security Engineering teams to improve detection coverage.
• Map detections to MITRE ATT&CK techniques and adversary behaviors.
• Analyze security logs from endpoints, cloud environments, applications, identity platforms, and network devices.
• Continuously tune detections to minimize false positives and improve operational efficiency.
• Support security investigations, incident response, and post-incident analysis.
• Develop metrics and reporting to measure cyber defense effectiveness.