AI-Driven Threat Detection Engineer

Idme; McLean (VA); On-site; USD 113,033 - 140,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

401(k) with company match

Unlimited PTO

Job summary

ID.me is seeking a Threat Detection Engineer to join its security engineering and operations team in Mountain View, CA. You will design, test, and optimize high‑fidelity detections across modern security platforms with a strong emphasis on AI‑driven techniques.

You will work on detection logic, IaC, and collaboration with incident response, threat intel, and platform engineering to cover cloud and enterprise environments, including AI systems, while supporting 24x7 on‑call rotation.

Qualifications

• 2–4 years in a security engineering or security operations role.
• Proficiency with Splunk, Elastic Stack, Google SecOps (Chronicle), and/or Logstash.
• Strong programming or scripting experience in Python and SQL.
• Working experience authoring detection logic using YARA-L, Sigma, or equivalent formats.
• Demonstrated AI literacy: hands‑on experience with LLM APIs for security use cases.
• Understanding of AI/ML concepts relevant to detection and anomaly detection.
• Ability to assess AI‑specific threats: prompt injection, model inversion, data poisoning.
• Experience working with cloud‑scale security data and log management tools.
• Familiarity with MITRE ATT&CK, threat modeling, and behavioral‑based detections.
• Knowledge of IaC and version control systems (GitHub, Terraform, GitLab CI/CD).

Responsibilities

• Design and implement detection logic across SIEM/SOAR platforms (Splunk, Chronicle, Elastic).
• Build scalable detection rules, analytics, and anomaly models aligned with MITRE ATT&CK.
• Develop and maintain detection‑as‑code using Python and YAML formats (Sigma, YARA-L).
• Design and evaluate LLM‑assisted detection and triage workflows, including prompt engineering.
• Build AI‑augmented detection pipelines: anomaly scoring and NLP parsing for phishing/social engineering.
• Apply AI security literacy to detect risks in AI‑integrated environments.
• Perform QA and validation of alerts to minimize false positives and improve signal fidelity.
• Leverage Snowflake/SQL to query telemetry sources including AI logs and API calls.
• Contribute to IaC workflows for detection deployment (Terraform, GitOps).
• Collaborate with Threat Intelligence and IR to translate TTPs into detections.
• Participate in red/blue team exercises and post‑incident reviews of AI‑assisted detection.
• Maintain 24x7 on‑call availability for security incidents during EST hours.

Skills

Splunk

Elastic Stack

Python

SQL

YARA-L

Sigma

LLM APIs

AI literacy

Cloud security data

IaC

Tools

Terraform

GitHub

CI/CD

Logstash

Kusto

Lucene

Job description

ID.me is seeking a Threat Detection Engineer to join its security engineering and operations team in Mountain View, CA. You will design, test, and optimize high‑fidelity detections across modern security platforms with a strong emphasis on AI‑driven techniques.

You will work on detection logic, IaC, and collaboration with incident response, threat intel, and platform engineering to cover cloud and enterprise environments, including AI systems, while supporting 24x7 on‑call rotation.