Detection Engineer

Vernovis, Ltd.; Westerville (OH); On-site; USD 90,000 - 110,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

Voluntary Short-Term Disability

Voluntary Long-Term Disability

Voluntary Life Insurance

401K

Job summary

Vernovis is seeking a Detection Engineer to design, implement, test, and tune detection rules within Google SecOps SIEM using YARA-L across endpoint, identity, network, cloud, and email telemetry. You will manage a detection backlog from development to deployment and tuning, aligning content to MITRE ATT&CK and building automated SOAR playbooks.

Ideal candidates have 3–5 years in security/detection engineering, hands-on SIEM rule development, and scripting (Python/PowerShell).

Qualifications

• 3–5 years of experience in security engineering, detection engineering, or a closely related security discipline.
• Hands-on experience developing detection rules within a SIEM using structured rule or query languages.
• Experience building automated workflows, playbooks, or integrations within a SOAR platform.
• Working proficiency with Python, PowerShell, or an equivalent scripting language.

Responsibilities

• Develop, test, deploy, and tune detection rules within Google SecOps SIEM using YARA-L across endpoint, identity, network, cloud, and email telemetry.
• Execute against a prioritized detection backlog, managing content through development, testing, validation, deployment, and tuning.
• Build new detection content based on threat intelligence, incident findings, platform changes, and identified security coverage gaps.
• Align detection content to the MITRE ATT&CK framework and follow detection-as-code practices.
• Build and configure SIEM data source integrations, connectors, log ingestion feeds, and parsing and normalization logic.
• Develop SOAR integrations and automated response playbooks to support triage, enrichment, response actions, and case management.
• Maintain and optimize Google SecOps SIEM/SOAR configurations while tracking detection effectiveness, alert fidelity, and coverage gaps.

Skills

Detection engineering

SIEM

SOAR integrations

Python/PowerShell

YARA-L

Threat intelligence

Tools

Google SecOps

Chronicle

YARA-L

SOAR

Job description

Job Title: Detection Engineer, Security Engineering
Location/ Work Structure: Westerville, OH | Onsite 5 days per week
Compensation: Salary or Hourly: $65–$80/hour | 1-year contract

Who we are

Vernovis is a Total Talent Solutions company that specializes in Technology, Cybersecurity, Finance & Accounting functions. At Vernovis, we help these professionals achieve their career goals, matching them with innovative projects and dynamic direct hire opportunities in Ohio and across the Midwest.

What You’ll Do:

Develop, test, deploy, and tune detection rules within Google SecOps SIEM using YARA-L across endpoint, identity, network, cloud, and email telemetry.

Execute against a prioritized detection backlog, managing content through development, testing, validation, deployment, and tuning.

Build new detection content based on threat intelligence, incident findings, platform changes, and identified security coverage gaps.

Align detection content to the MITRE ATT&CK framework and follow detection-as-code practices.

Build and configure SIEM data source integrations, connectors, log ingestion feeds, and parsing and normalization logic.

Develop SOAR integrations and automated response playbooks to support triage, enrichment, response actions, and case management.

Maintain and optimize Google SecOps SIEM/SOAR configurations while tracking detection effectiveness, alert fidelity, and coverage gaps.

What Experience You'll Have:

3–5 years of experience in security engineering, detection engineering, or a closely related security discipline.

Hands-on experience developing detection rules within a SIEM using structured rule or query languages.

Experience building automated workflows, playbooks, or integrations within a SOAR platform.

Working proficiency with Python, PowerShell, or an equivalent scripting language, along with a strong understanding of attacker methodologies and security telemetry.

What Experience is Nice to Have:

Direct experience with Google SecOps/Chronicle, including YARA-L rule development and SOAR playbook creation.

Experience with log parsing, data normalization, detection-as-code, Git-based workflows, and CI/CD pipelines.

Familiarity with cloud security telemetry, EDR platforms, and certifications such as GCIA, GCDA, or GCED.

The Vernovis Difference:

Vernovis offers Health, Dental, Vision, Voluntary Short & Long -Term Disability, Voluntary Life Insurance, and 401K.

Vernovis does not accept inquiries from Corp to Corp recruiting companies. Applicants must be currently authorized to work in the United States on a full-time basis and not violate any immigration or discrimination laws.

Vernovis provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state, or local laws.

This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation, and training.

By applying for this job, you agree to receive calls, AI-generated calls, text messages, or emails from and its affiliates, and contracted partners. Frequency varies for text messages. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You can reply STOP to cancel and HELP for help. You can access our privacy policy at https://vernovis.com/privacy-policy-2/.