Cloud Detection Engineer — IDS/IPS & Cloud Logs

BreakPoint Labs LLC; Charleston (SC); Hybrid; USD 120,000 - 150,000; Full time

Job summary

BreakPoint Labs LLC seeks a Detection Engineer to design, develop, and implement advanced detection capabilities within a CSSP environment. You will focus on IDS/IPS signatures, log correlation rules, and detection tools across multi-cloud environments.

You will analyze threat intel to tailor detection mechanisms, validate rules to minimize false positives, and collaborate with DCO Watch Analysts to integrate detections into monitoring and incident response workflows.

Qualifications

• 5+ years in a Cloud CSSP, SOC, or similar environment.
• 2+ years in signature development and detection logic on multiple platforms.
• Experience with major cloud provider security models, services and logs.
• Experience with threat intelligence platforms and indicator management.

Responsibilities

• Act as the primary SME for cloud log sources, designing efficient detections across multi-cloud environments.
• Designing and implementing detection logic (KQL, EQL, and SPL) for cloud threats and infrastructure.
• Analyzing threat intelligence to tailor detections to customer environments.
• Validating detection rules to minimize false positives and enhance threat identification.
• Collaborating with DCO Watch Analysts to integrate detections into monitoring workflows.

Skills

IDS/IPS

Threat detection

Splunk

Elastic

KQL/EQL/SPL

Cloud security

Indicator lifecycle

SOP documentation

Communication

Problem solving

Education

Bachelor’s Degree

Tools

Splunk

Elastic

Job description

BreakPoint Labs LLC seeks a Detection Engineer to design, develop, and implement advanced detection capabilities within a CSSP environment. You will focus on IDS/IPS signatures, log correlation rules, and detection tools across multi-cloud environments.

You will analyze threat intel to tailor detection mechanisms, validate rules to minimize false positives, and collaborate with DCO Watch Analysts to integrate detections into monitoring and incident response workflows.