Detection & Automation Engineer: AI-Driven Threat Hunting

OpenTalent; Manhattan Beach (CA); On-site; USD 140,000 - 200,000; Full time

Job summary

OpenTalent in Manhattan Beach, CA is seeking a security detection engineer to source, integrate, and analyze log and event data to build insights, detections, and dashboards. You will prioritize and tune detection logic based on threat intelligence and adversary behavior, and document results and procedures.

Responsibilities include expanding telemetry quality, driving threat hunting and purple-team activities, and developing security automation playbooks using deterministic actions and

Qualifications

• Advanced experience with event log management, aggregation, alerting, and monitoring.
• Experience developing, tuning, testing, and documenting detection rules and alerts.
• Experience with SOAR automation platforms, APIs, webhooks, and scripting languages (Python/PowerShell).
• Deep understanding of identity and access management, network architecture, and systems hardening in a large heterogeneous environment.
• Experience with Windows, Linux, and macOS servers/workstations.
• Strong cloud experience (AWS, Azure, GCP) is a plus.

Responsibilities

• Source, integrate, and leverage log and event data to create insights and develop detections, and dashboards.
• Prioritize, develop, test, tune, and maintain detection logic, rules, and alerts based on threat intelligence and adversary behavior.
• Develop and maintain documentation of detection logic, data requirements, and response procedures.
• Improve telemetry quality by evaluating source integrations, parsing, normalization, and logging practices.

Skills

Event log management

Detection rules & alerts

SOAR automation

Python/PowerShell scripting

IAM knowledge

Cross-platform servers

Cloud services (AWS/Azure/GCP)

Tools

SOAR platforms

Job description

OpenTalent in Manhattan Beach, CA is seeking a security detection engineer to source, integrate, and analyze log and event data to build insights, detections, and dashboards. You will prioritize and tune detection logic based on threat intelligence and adversary behavior, and document results and procedures.

Responsibilities include expanding telemetry quality, driving threat hunting and purple-team activities, and developing security automation playbooks using deterministic actions and