Detection & Automation Engineer III

Milwaukee Succeeds

Milwaukee (WI)

Hybrid

USD 108,000 - 162,000

Full time

15 hours ago

Be an early applicant

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Benefits offered by this job

Flexible work schedules

Concierge service

Comprehensive benefits

Employee resource groups

Job summary

Northwestern Mutual is seeking a Detection & Automation Engineer III to advance threat detection across cloud, identity, endpoint, database, and application environments. You will blend DevOps, detection engineering, SIEM, telemetry, and data integration to bolster security visibility and threat response.

You will lead, mentor, and collaborate across cybersecurity, infrastructure, cloud, and application teams to onboard telemetry, reduce false positives, and drive continuous improvements in

Qualifications

Bachelor’s degree or equivalent professional experience in a related field.
2+ years in cybersecurity, detection engineering, security operations, SIEM engineering, or related disciplines.
Hands-on experience developing and maintaining threat detections within Splunk Enterprise Security or comparable SIEM.
Experience with cloud platforms, identity systems, endpoint security technologies, applications, databases, and enterprise infrastructure.

Responsibilities

Design, develop, test, and maintain advanced threat detections across a variety of security platforms and data sources.
Enhance detection coverage by identifying telemetry gaps and partnering with stakeholders to improve visibility across the environment.
Administer and optimize Splunk Enterprise Security, including ES frameworks, data models, reporting, dashboards, and search performance.
Troubleshoot and resolve security data ingestion, field extraction, parsing, normalization, and performance issues.
Partner with technology teams to onboard new security data sources and validate telemetry quality.
Develop and maintain security logging standards, monitoring controls, and data quality processes.
Design monitoring capabilities for enterprise databases and business-critical applications, focusing on privileged access, authentication activity, anomalous behavior, and sensitive data access.
Contribute to Detection-as-Code initiatives through version control, automated testing, CI/CD pipelines, and reusable detection frameworks.
Track and improve key metrics including detection coverage, alert fidelity, telemetry health, and operational effectiveness.
Drive continuous improvement efforts that reduce false positives, improve detection accuracy, and streamline security operations.
Provide technical leadership, mentor junior engineers, and contribute to architectural and engineering best practices.

Skills

Detection Engineering

Security Monitoring

Cloud Security

SIEM Engineering

Scripting & Automation

Analytical Thinking

Communication Skills

Education

Bachelor’s degree in Cybersecurity/IT/CS/Engineering

Tools

Splunk Enterprise Security

Cribl Stream

Job description

At Northwestern Mutual, our cybersecurity team is focused on protecting our clients, advisors, and business platforms through innovative detection and automation capabilities. As a Detection & Automation Engineer III, you will play a key role in enhancing our ability to identify, investigate, and respond to cybersecurity threats across cloud, identity, endpoint, database, and application environments.

This position blends DevOps, detection engineering, SIEM administration, telemetry engineering, and data integration to improve security visibility and strengthen our threat detection program. You'll work closely with cybersecurity, infrastructure, cloud, and application teams to build scalable detection capabilities, onboard critical security telemetry, and drive continuous improvements across our security operations ecosystem.

What You'll Do:

Design, develop, test, and maintain advanced threat detections across a variety of security platforms and data sources.
Enhance detection coverage by identifying telemetry gaps and partnering with stakeholders to improve visibility across the environment.
Administer and optimize Splunk Enterprise Security, including ES frameworks, data models, reporting, dashboards, and search performance.
Troubleshoot and resolve security data ingestion, field extraction, parsing, normalization, and performance issues.
Partner with technology teams to onboard new security data sources and validate telemetry quality.
Develop and maintain security logging standards, monitoring controls, and data quality processes.
Design monitoring capabilities for enterprise databases and business-critical applications, focusing on privileged access, authentication activity, anomalous behavior, and sensitive data access.
Contribute to Detection-as-Code initiatives through version control, automated testing, CI/CD pipelines, and reusable detection frameworks.
Track and improve key metrics including detection coverage, alert fidelity, telemetry health, and operational effectiveness.
Drive continuous improvement efforts that reduce false positives, improve detection accuracy, and streamline security operations.
Provide technical leadership, mentor junior engineers, and contribute to architectural and engineering best practices.

What You’ll Bring to the Role:

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field, or equivalent professional experience.
2+ years of experience in cybersecurity, detection engineering, security operations, SIEM engineering, or related disciplines.
Hands-on experience developing and maintaining threat detections within Splunk Enterprise Security or comparable SIEM platforms.
Strong understanding of security monitoring, log management, telemetry engineering, and threat detection methodologies.
Experience working with cloud platforms, identity systems, endpoint security technologies, applications, databases, and enterprise infrastructure.
Knowledge of security frameworks, including MITRE ATT&CK, and their application to threat detection strategies.
Experience onboarding, normalizing, and validating security data from multiple sources.
Familiarity with scripting or automation technologies such as Python, PowerShell, or similar languages.
Experience with source control platforms, automated testing, and CI/CD pipelines.
Strong troubleshooting, analytical, and problem-solving skills with the ability to identify complex security issues and implement scalable solutions.
Excellent communication and collaboration skills with the ability to work effectively across technical and business teams.

Preferred Qualifications

Experience with Splunk Enterprise and/or Cribl Stream.
Experience supporting cybersecurity monitoring and logging requirements within regulated environments.
Background in database administration, enterprise data engineering, or large-scale telemetry architectures.
Experience implementing Detection-as-Code methodologies and security automation solutions.
Knowledge of audit logging standards, security monitoring controls, and modern security observability practices.
Relevant industry certifications such as Splunk Core Certified Power User, Splunk Enterprise Certified Administrator, GIAC, CISSP, GCIA, GCIH, or equivalent.

#LI-Hybrid

Compensation Range:

Pay Range - Start:

$108,160.00

Pay Range - End:

$162,240.00

Geographic Specific Pay Structure:

Structure 110:

Structure 115:

We believe in fairness and transparency. It's why we share the salary range for most of our roles. However, final salaries are based on a number of factors, including the skills and experience of the candidate; the current market; location of the candidate; and other factors uncovered in the hiring process. The standard pay structure is listed but if you're living in California, New York City or other eligible location, geographic specific pay structures, compensation and benefits could be applicable, click here to learn more.

Northwestern Mutual is an equal opportunity employer that welcomes talented individuals of all backgrounds. We are committed to creating and maintaining an environment in which each employee can contribute creative ideas, seek challenges, assume leadership and continue to focus on meeting and exceeding business and personal objectives.

Skills

Security Monitoring & Defense (NM), Risk Management (NM), Cloud Security (NM), Cyber Threat Intelligence (NM), Cloud & IT Infrastructure, Application Performance & Maintenance (NM), Collaborative Partnership & Planning (NM), Detection Engineering (NM), Professional Curiosity (NM) - Advanced (Inactive), Customer Centricity (NM), Coaching & Mentoring (NM), Engineering Expertise & Practices, Emerging Technology Evaluation (NM), Technical Issue Triage (NM), Analytical Thinking (NM), Attack Method Countermeasures, Software Development (NM), Strategic & Systems Thinking (NM), Adaptive Communication (NM), Scripting & Integration (NM), Security Practices

FIND YOUR FUTURE

We're excited about the potential people bring to Northwestern Mutual. You can grow your career here while enjoying first-class perks, benefits, and our commitment to a culture of belonging.

Flexible work schedules
Concierge service
Comprehensive benefits
Employee resource groups

EEO/AA Employer/Vets/Disability

What You’ll Do:

Design, develop, test, and maintain advanced threat detections across a variety of security platforms and data sources.
Enhance detection coverage by identifying telemetry gaps and partnering with stakeholders to improve visibility across the environment.
Administer and optimize Splunk Enterprise Security, including ES frameworks, data models, reporting, dashboards, and search performance.
Troubleshoot and resolve security data ingestion, field extraction, parsing, normalization, and performance issues.
Partner with technology teams to onboard new security data sources and validate telemetry quality.
Develop and maintain security logging standards, monitoring controls, and data quality processes.
Design monitoring capabilities for enterprise databases and business-critical applications, focusing on privileged access, authentication activity, anomalous behavior, and sensitive data access.
Contribute to Detection-as-Code initiatives through version control, automated testing, CI/CD pipelines, and reusable detection frameworks.
Track and improve key metrics including detection coverage, alert fidelity, telemetry health, and operational effectiveness.
Drive continuous improvement efforts that reduce false positives, improve detection accuracy, and streamline security operations.
Provide technical leadership, mentor junior engineers, and contribute to architectural and engineering best practices.

What You’ll Bring to the Role:

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field, or equivalent professional experience.
2+ years of experience in cybersecurity, detection engineering, security operations, SIEM engineering, or related disciplines.
Hands-on experience developing and maintaining threat detections within Splunk Enterprise Security or comparable SIEM platforms.
Strong understanding of security monitoring, log management, telemetry engineering, and threat detection methodologies.
Experience working with cloud platforms, identity systems, endpoint security technologies, applications, databases, and enterprise infrastructure.
Knowledge of security frameworks, including MITRE ATT&CK, and their application to threat detection strategies.
Experience onboarding, normalizing, and validating security data from multiple sources.
Familiarity with scripting or automation technologies such as Python, PowerShell, or similar languages.
Experience with source control platforms, automated testing, and CI/CD pipelines.
Strong troubleshooting, analytical, and problem-solving skills with the ability to identify complex security issues and implement scalable solutions.
Excellent communication and collaboration skills with the ability to work effectively across technical and business teams.

Preferred Qualifications

Experience with Splunk Enterprise and/or Cribl Stream.
Experience supporting cybersecurity monitoring and logging requirements within regulated environments.
Background in database administration, enterprise data engineering, or large-scale telemetry architectures.
Experience implementing Detection-as-Code methodologies and security automation solutions.
Knowledge of audit logging standards, security monitoring controls, and modern security observability practices.
Relevant industry certifications such as Splunk Core Certified Power User, Splunk Enterprise Certified Administrator, GIAC, CISSP, GCIA, GCIH, or equivalent.

#LI-Hybrid

Compensation Range:

Pay Range - Start:

$108,160.00

Pay Range - End:

$162,240.00

Geographic Specific Pay Structure:

Structure 110:

Structure 115:

Skills

FIND YOUR FUTURE

We're excited about the potential people bring to Northwestern Mutual. You can grow your career here while enjoying first-class perks, benefits, and our commitment to a culture of belonging.