Cyber Security Engineer – Threat Detection

Sharp Decisions; Charlotte (NC); Hybrid; USD 110,000 - 140,000; Full time

Job summary

Sharp Decisions is seeking a Cyber Security Engineer – Threat Detection in Charlotte, NC, operating in a hybrid model. The role focuses on building, tuning, and maintaining detection logic across cloud and on‑premises environments to proactively identify threats and drive fast response.

The ideal candidate has 3+ years of direct cybersecurity or detection engineering experience, with hands‑on telemetry, analytics, automation, and detection‑as‑code practices, collaborating with analysts and

Qualifications

• Minimum 3 years of direct cybersecurity, detection engineering, SOC engineering, or security analytics experience.

Responsibilities

• Design, develop, tune, and maintain threat detection logic across cloud and on‑premises environments.
• Build and maintain data ingestion pipelines for security telemetry from infrastructure, apps, endpoints, identity platforms, and cloud services.
• Partner with threat intelligence teams to translate threats into actionable detection strategies.
• Collaborate with analysts, incident responders, SOC engineers, and technology teams to investigate detections and reduce MTTD/MTTR.
• Develop and fine‑tune detection rules, signatures, and alerting thresholds to improve fidelity and reduce false positives.
• Map detections to MITRE ATT&CK to support monitoring and response improvements.
• Use automation and detection‑as‑code practices to improve content lifecycle management.
• Evaluate monitoring technologies and data sources to enhance detection coverage and efficiency.
• Ensure alignment with compliance and internal control requirements.
• Create and maintain clear documentation for detection logic and playbooks.
• Continuously assess monitoring controls to strengthen cyber resilience.

Skills

Detection engineering

SOC engineering

Security analytics

Threat detection

Automation

Telemetry data analysis

Job description

Cyber Security Engineer – Threat Detection

Charlotte, NC — Hybrid
W2 Only Mid-Level —
5 to 7 Years
Banking / Financial Services MITRE ATT&CK

Our client is seeking an experienced detection engineering professional to join a high-performing Security Operations team responsible for advancing security monitoring, detection engineering, and cyber defense capabilities within a major financial institution. This role focuses on building, tuning, and maintaining effective detections across cloud and on-premises environments to proactively identify, investigate, and respond to threats. The successful candidate will bring hands-on experience with security telemetry, analytics, automation, and detection-as-code practices, and will be expected to execute with limited guidance while collaborating closely with analysts, incident responders, threat intelligence, and technology partners.

? Critical Requirements

• Minimum 3 years of direct cybersecurity, detection engineering, SOC engineering, or security analytics experience

Role Objectives

• Design, develop, tune, and maintain threat detection logic across cloud and on-premises environments to improve visibility, alert quality, and response effectiveness
• Build and maintain efficient data ingestion and log onboarding pipelines for security-relevant telemetry from infrastructure, applications, endpoints, identity platforms, and cloud services
• Partner with threat intelligence teams to translate emerging threats, attacker techniques, and indicators of compromise into actionable detection strategies
• Collaborate with security analysts, incident responders, SOC engineers, and cross-functional technology teams to investigate detections, validate coverage, and reduce time to detect and respond
• Develop and fine-tune detection rules, signatures, correlation logic, behavioral analytics, and alerting thresholds to improve fidelity and reduce false positives
• Map detections and coverage to relevant frameworks including MITRE ATT&CK to support measurable improvements in monitoring and response capabilities
• Use automation, scripting, and detection-as-code practices to improve consistency, scalability, testing, deployment, and lifecycle management of detection content
• Evaluate security monitoring technologies, data sources, and analytics capabilities to identify opportunities to enhance detection coverage and operational efficiency
• Ensure detection engineering practices align with applicable compliance, regulatory, and internal control requirements
• Create and maintain clear documentation for detection logic, data sources, tuning decisions, operational procedures, and response playbooks
• Continuously assess the effectiveness of cybersecurity monitoring controls and recommend improvements to strengthen cyber resilience