Security Detection Engineer III

F5 Networks, Inc.; Warszawa; Hybrid; PLN 260,000 - 380,000; Full time

Job summary

F5 Networks, Inc. in Warsaw, Poland, is seeking a Security Engineer III to design, implement, and refine detection content across SIEM/EDR platforms.

You will collaborate with incident response and threat intelligence teams to translate threats into reliable detections and automation. Join a hybrid work environment with on-call rotation, travel up to 5%, and a focus on scalable detection engineering, AI considerations, and secure cloud, network, and endpoint coverage.

Qualifications

• Bachelor's degree in Information Security, Computer Science, Engineering, or related field, or equivalent practical experience.
• 5+ years of experience in cybersecurity, security engineering, detection engineering, security operations, threat hunting, or a related discipline.
• Experience developing, tuning, or maintaining detections within a SIEM, EDR, log analytics, or security monitoring platform.
• Experience with scripting, automation, or data analysis using Python, PowerShell, SQL, KQL, SPL, or similar technologies.
• Strong understanding of attacker techniques, detection methodologies, and frameworks such as MITRE ATT&CK.
• Strong analytical, problem-solving, communication, and cross-functional collaboration skills.

Responsibilities

• Develop and maintain custom detections using Detection-as-Code practices, including version control, peer review, testing, and CI/CD deployment workflows.
• Analyze and improve detection coverage by mapping telemetry and detections to adversary behaviors and the MITRE ATT&CK framework, identifying gaps and prioritizing enhancements.
• Partner with Incident Response, Threat Intelligence, Logging Engineering, and security platform teams to translate emerging threats, investigations, and telemetry into actionable detection content.
• Validate and tune detections through adversary emulation, atomic testing, purple-team exercises, and production feedback to improve signal quality and reduce false positives.
• Automate and optimize detection engineering workflows, alert enrichment processes, and operational activities to improve efficiency and scalability.
• Support onboarding of new log sources and security telemetry by collaborating with engineering and infrastructure teams to establish detection coverage across new environments and technologies.
• Create and maintain detection documentation, runbooks, coverage assessments, and technical standards while participating in an engineering on-call rotation.
• Help define detection strategy for AI and agentic systems (prompt injection, tool and function abuse, agent identity and credential misuse, data exfiltration via model outputs), and explore using AI to accelerate detection engineering workflows.

Skills

Scripting & automation

MITRE ATT&CK knowledge

SIEM / EDR experience

Cross-functional collaboration

Cloud/endpoint/network detection

Education

Bachelor's degree or equivalent in Information Security / CS / Eng

Tools

Splunk

Microsoft Sentinel

CrowdStrike

Elastic

Job description

At F5, we strive to bring a better digital world to life. Our teams empower organizations across the globe to create, secure, and run applications that enhance how we experience our evolving digital world. We are passionate about cybersecurity, from protecting consumers from fraud to enabling companies to focus on innovation. Everything we do centers around people. That means we obsess over how to make the lives of our customers, and their customers, better. And it means we prioritize a diverse F5 community where each individual can thrive.

Primary Responsibilities

• Develop and maintain custom detections using Detection-as-Code practices, including version control, peer review, testing, and CI/CD deployment workflows.
• Analyze and improve detection coverage by mapping telemetry and detections to adversary behaviors and the MITRE ATT&CK framework, identifying gaps and prioritizing enhancements.
• Partner with Incident Response, Threat Intelligence, Logging Engineering, and security platform teams to translate emerging threats, investigations, and telemetry into actionable detection content.
• Validate and tune detections through adversary emulation, atomic testing, purple-team exercises, and production feedback to improve signal quality and reduce false positives.
• Automate and optimize detection engineering workflows, alert enrichment processes, and operational activities to improve efficiency and scalability.
• Support onboarding of new log sources and security telemetry by collaborating with engineering and infrastructure teams to establish detection coverage across new environments and technologies.
• Create and maintain detection documentation, runbooks, coverage assessments, and technical standards while participating in an engineering on-call rotation.
• Help define detection strategy for AI and agentic systems (prompt injection, tool and function abuse, agent identity and credential misuse, data exfiltration via model outputs), and explore using AI to accelerate detection engineering workflows.

Required Skills / Qualifications

• Bachelor's degree in Information Security, Computer Science, Engineering, or related field, or equivalent practical experience.
• 5+ years of experience in cybersecurity, security engineering, detection engineering, security operations, threat hunting, or a related discipline.
• Experience developing, tuning, or maintaining detections within a SIEM, EDR, log analytics, or security monitoring platform.
• Experience with scripting, automation, or data analysis using Python, PowerShell, SQL, KQL, SPL, or similar technologies.
• Strong understanding of attacker techniques, detection methodologies, and frameworks such as MITRE ATT&CK.
• Strong analytical, problem-solving, communication, and cross-functional collaboration skills.

Preferred Skills / Qualifications

• Experience implementing Detection-as-Code practices, including Git-based workflows, automated testing, and CI/CD pipelines.
• Experience with adversary emulation, atomic testing, purple-team exercises, or detection validation frameworks.
• Experience performing detection coverage analysis and developing ATT&CK-based coverage roadmaps.
• Experience onboarding log sources and building detections across cloud, endpoint, network, identity, or SaaS environments.
• Experience with platforms such as CrowdStrike, Splunk, Microsoft Sentinel, Chronicle, Elastic, or similar security technologies.
• Familiarity with AI/LLM threat models (prompt injection, tool and function abuse, agent identity and credential misuse, data exfiltration via model outputs) or frameworks such as MITRE ATLAS and the OWASP LLM Top 10 — and interest in applying AI to accelerate detection engineering workflows.

Work Environment

This is a full-time engineering role and is not a shift-based position. Participation in an engineering on-call rotation is required and may occasionally require support outside normal business hours during critical incidents, platform outages, or detection-related operational events. The Security Engineer III may be engaged as a subject matter expert during security incidents but is not responsible for primary incident response or SOC operations. Travel may be required up to 5%, including occasional international travel.

Equal Employment Opportunity

It is the policy of F5 to provide equal employment opportunities to all employees and employment applicants without regard to unlawful considerations of race, religion, color, national origin, sex, sexual orientation, gender identity or expression, age, sensory, physical, or mental disability, marital status, veteran or military status, genetic information, or any other classification protected by applicable local, state, or federal laws. This policy applies to all aspects of employment, including, but not limited to, hiring, job assignment, compensation, promotion, benefits, training, discipline, and termination. F5 offers a variety of reasonable accommodations for candidates. Requesting an accommodation is completely voluntary. F5 will assess the need for accommodations in the application process separately from those that may be needed to perform the job. Request by contacting [e-mail].

Hybrid / Remote Policy

Hybrid: Employees within 30 commutable miles of an F5 office are required to work from the office a minimum of 30 business days per quarter. Remote: Primarily work from designated home location but can come into an F5 office to work or travel to an offsite location as needed.

Company Overview

Together, we're building a better digital world. Founded in 1996, F5 is a global leader in application delivery and security. Our premier platform helps customers secure and deliver every app, API, and piece of infrastructure across all environments. Backed by over three decades of expertise and 553 patents, our solutions protect against threats while ensuring fast, reliable digital experiences. With over 6,400 employees, we serve more than 23,000 customers in over 170 countries. To continue this work, we need people like you—the best minds in the industry. We're committed to a unique, human-first culture that encourages authenticity, prioritizes diversity and inclusion, and fosters the growth and success of our employees.

General Statement

The Job Description is intended to be a general representation of the responsibilities and requirements of the job. However, the description may not be all-inclusive, and responsibilities and requirements are subject to change.