AI-Driven Threat Detection Engineer – SIEM & Cloud

Socket.dev; McLean (VA); On-site; USD 113,033 - 140,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

401(k) with company match

Paid time off and holidays

Job summary

ID.me is seeking a Threat Detection Engineer to join our security engineering and operations team. You will develop high-fidelity detections across modern security data platforms, focusing on analytics, automation, and AI-enabled threat detection at scale.

You will build AI-enhanced detection workflows and ensure coverage across cloud and on-prem environments. Responsibilities include designing detection logic for SIEM/SOAR platforms, implementing detection-as-code, and collaborating with IR and

Qualifications

• 2-4 years in a security engineering or security operations role.
• Proficiency with Splunk, Elastic Stack, Google SecOps (Chronicle), and/or Logstash.
• Strong programming or scripting experience in Python and SQL.
• Working experience authoring detection logic using YARA-L, Sigma, or equivalent formats.
• Demonstrated AI literacy: hands-on experience using LLM APIs or AI/ML frameworks for security use cases.

Responsibilities

• Design and implement detection logic across SIEM/SOAR platforms.
• Build scalable detection rules, analytics, and anomaly models to detect MITRE ATT&CK TTPs.
• Develop and maintain detection-as-code using Python and YAML-based rule formats.
• Design and evaluate LLM-assisted detection and triage workflows.

Skills

AI literacy

Threat detection

Security analytics

Incident response

Tools

Splunk

Elastic Stack

Google SecOps (Chronicle)

Logstash

Job description

ID.me is seeking a Threat Detection Engineer to join our security engineering and operations team. You will develop high-fidelity detections across modern security data platforms, focusing on analytics, automation, and AI-enabled threat detection at scale.

You will build AI-enhanced detection workflows and ensure coverage across cloud and on-prem environments. Responsibilities include designing detection logic for SIEM/SOAR platforms, implementing detection-as-code, and collaborating with IR and