AI-Driven Detection Engineer for Security Ops

CipherData; Bellevue (WA); On-site; USD 120,000 - 180,000; Full time

Job summary

CipherData is seeking a Security Engineer to design and refine detection and correlation rules for our AIDR platform. You will work alongside the AI engineering team and contribute to ground truth labeling, threat research, and incident response in live customer environments.

The role is suited for a hands-on engineer with a few years in SOC/detection who can scale responsibilities rapidly, potentially advancing to senior capability ownership as the team grows.

Qualifications

• 3+ years hands-on in a SOC, detection engineering, threat hunting, or incident response role.
• Experience writing and tuning detections in production and explaining false-positive trade-offs.
• Experience with at least one SIEM or security data platform and EDR/XDR telemetry.

Responsibilities

• Write, test, tune, and retire detection logic and correlation rules.
• Label real investigations into benchmark datasets and document false conclusions.
• Track attacker tradecraft and turn it into detection content and test cases.
• Contribute to normalization, enrichment, and query patterns in our security lakehouse.
• Help deploy, tune, and validate AIDR in customer environments and feedback detection.
• Participate in incident response and post-incident reviews.

Skills

SOC experience

Detections engineering

Python

Code review

Ownership

Tools

SIEM

EDR/XDR

Job description

CipherData is seeking a Security Engineer to design and refine detection and correlation rules for our AIDR platform. You will work alongside the AI engineering team and contribute to ground truth labeling, threat research, and incident response in live customer environments.

The role is suited for a hands-on engineer with a few years in SOC/detection who can scale responsibilities rapidly, potentially advancing to senior capability ownership as the team grows.