Threat Detection & Response Engineer III

True Anomaly; Quinte West; On-site; CAD 161,000 - 231,000; Full time

Benefits offered by this job

Best-in-class healthcare

Generous time off (FTO, PTO, holidays)

Daily catered lunch & unlimited snacks

Equity participation

401(k) retirement plan

Job summary

True Anomaly, Inc. seeks a Threat Detection & Response Engineer III to help build and mature our detection capabilities, response processes, and security tooling that underpin our security operations program.

You will design and implement detections, tune rules, and lead incident response activities in a fast-paced environment with real impact on security posture. The ideal candidate takes initiative, enjoys solving hard problems, and will operate with a strong sense of ownership in a growing

Qualifications

• Active Secret/TS security clearance required.
• 3+ years of cybersecurity experience with at least 2 years in security operations, detection engineering, incident response, or threat hunting.
• Experience building or tuning security detections and familiarity with risk-based alerting.
• Knowledge of EDR platforms and basic alert triage.
• Familiarity with SIEM platforms and log analysis (Splunk/Elastic).
• Experience with scripting for automation (Python/PowerShell/Bash).
• Understanding of MITRE ATT&CK, Cyber Kill Chain, and common attack techniques.

Responsibilities

• Develop incident response plans, playbooks, and SOPs; build scalable processes to support future team growth.
• Design and implement custom security detections across corporate and cloud environments, leveraging frameworks like MITRE ATT&CK.
• Continuously tune detection rules and develop threat models to improve fidelity and address coverage gaps.
• Monitor, triage, and respond to security alerts across multiple platforms and data sources.
• Perform incident investigations through technical analysis, containment, eradication, and recovery; document findings and lessons learned.
• Proactively hunt for threats and leverage threat intelligence to anticipate emerging adversary TTPs.
• Administer and optimize EDR and SIEM platforms; integrate log sources to enhance visibility and correlation.
• Build automation and orchestration workflows to improve response efficiency.
• Partner with cross-functional teams and communicate technical findings to diverse stakeholders.

Skills

Active Secret/TS clearance

Cybersecurity experience

Security operations

Threat hunting

Scripting (Python/PowerShell/Bash)

EDR platforms

SIEM platforms

MITRE ATT&CK knowledge

Tools

Splunk

Elastic

Job description

Space is a warfighting domain. True Anomaly seeks those with the talent and ambition to build the technology that secures it.

OUR MISSION

True Anomaly delivers decisive capabilities for space superiority. We build autonomous spacecraft, advanced payloads, mission software, and space-based interceptors — enabling the U.S. and its Allies to secure the space environment and counter threats from the ultimate high ground.

OUR VALUES

• Be the offset. We create asymmetric advantages with creativity and ingenuity.
• What would it take? We challenge assumptions to deliver ambitious results.
• It’s the people. Our team is our competitive advantage and we are better together.

BENEFITS & PERKS*

• Best-in-class healthcare: 100% company-paid medical, dental, and vision coverage for you and your dependents, with HSA/HRA options
• Generous time off: Flexible Time Off (FTO) for exempt employees, accrued PTO of up to 25 days for non-exempt employees, plus 12 paid holidays; Parental Leave; Sick Leave
• Fuel for your day: Daily catered lunch and unlimited snacks for in-office employees
• And more: 401(k) retirement plan, fitness reimbursement, and Dog Fridays
• Equity participation: Equity is included as part of our total compensation package, giving you an opportunity to share in the company’s success.

*Do not apply to fixed term and temporary roles

YOUR MISSION

As a Threat Detection & Response Engineer III, you will be an integral part of our threat detection and response function, helping build and mature the detection capabilities, response processes, and security tooling that underpin our security operations program.

You’ll design and implement detection capabilities, sharpen our incident response procedures, and contribute to the foundation of a world-class security program. Expect a fast-paced environment where your work carries real weight and directly influences our security posture.

This role is a great fit for someone who takes initiative, enjoys digging into hard problems, and wants to make a tangible impact on a growing security program.

This position requires an active security clearance.

Responsibilities

• Develop incident response plans, playbooks, and SOPs; build scalable processes to support future team growth
• Design and implement custom security detections across corporate and cloud environments, leveraging frameworks like MITRE ATT&CK
• Continuously tune detection rules and develop threat models to improve fidelity and address coverage gaps
• Monitor, triage, and respond to security alerts across multiple platforms and data sources
• Perform incident investigations through technical analysis, containment, eradication, and recovery; document findings and lessons learned
• Proactively hunt for threats and leverage threat intelligence to anticipate emerging adversary TTPs
• Administer and optimize EDR and SIEM platforms; integrate log sources to enhance visibility and correlation
• Build automation and orchestration workflows to improve response efficiency
• Partner with cross-functional teams (IT, Engineering, Legal, Compliance) and communicate technical findings to diverse stakeholders

QUALIFICATIONS

A good candidate will have:

• Active Secret/TS security clearance and ability to maintain a security clearance
• 3+ years of experience in cybersecurity, with at least 2 years focused on security operations, detection engineering, incident response, or threat hunting
• Experience in building or tuning security detections
• Familiarity with risk-based alerting and alert tuning, including strategies to reduce noise, improve detection fidelity, and prioritize high-signal alerts
• Familiarity with EDR platforms, including basic alert triage and response actions
• Working knowledge of Windows, MacOS, or Linux endpoint security and common attack techniques
• Familiarity with SIEM platforms and log analysis (e.g., Splunk, Elastic, or similar)
• Basic understanding of common attack vectors, TTPs, and security frameworks such as MITRE ATT&CK and the Cyber Kill Chain
• Experience with scripting (Python, PowerShell, or Bash) for automation or analysis tasks
• Clear verbal and written communication skills

PREFERRED QUALIFICATIONS

An ideal candidate will also have:

• Knowledge of digital forensics and malware analysis techniques
• Experience building or significantly maturing a detection and response program
• Experience working in Azure Government Cloud (Azure GovCloud) environments
• Experience with cloud security monitoring in AWS, GCP, or Azure commercial environments
• Familiarity with CMMC, FedRAMP, NIST 800-53, or other federal compliance frameworks
• Experience with Detections-as-Code paradigms, GitOps, CI/CD, etc
• Experience participating in or supporting red team/purple team exercises

WORK ENVIRONMENT

• This role must be onsite in our Denver or Long Beach offices #LIOnsite
• This role operates in a fast-paced, high-stakes environment where rapid decision-making and adaptability are essential
• On-call rotation participation, including after-hours participation, is required for incident response coverage
• Must be comfortable working under pressure during active security incidents
• High degree of autonomy and ownership
• Direct access to leadership and opportunity to influence security strategy

WHAT WE OFFER

• Competitive salary
• Opportunity to work on challenging, mission-critical security initiatives
• Professional development and certification support
• Collaborative culture with experienced security professionals
• Equity + Benefits including Health, Dental, Vision, HRA/HSA options, PTO and paid holidays, 401K, Parental Leave

COMPENSATION

• Base Salary: Denver - $115,000 - $160,000, Long Beach - $120,000 - $165,000
• Equity + Benefits including Health, Dental, Vision, HRA/HSA options, PTO and paid holidays, 401K, Parental Leave
• Your actual level and base salary will bedetermined on a case-by-case basis and may vary based on the following considerations: job-related knowledge and skills, education, location, and experience.

This position will be open until it is successfully filled.

To conform to U.S. Government space technology export regulations, including the International Traffic in Arms Regulations (ITAR) you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.

To conform to U.S. Government space technology export regulations, including the International Traffic in Arms Regulations (ITAR) you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.

True Anomaly is committed to equal employment opportunity on any basis protected by applicable state and federal laws. If you have a disability or additional need that requires accommodation, please do not hesitate to let us.

True Anomaly is committed to equal employment opportunity on any basis protected by applicable state and federal laws. If you have a disability or additional need that requires accommodation, please do not hesitate to let us know.