Detection Engineer: EDR/ITDR & MITRE ATT&CK Expert

ThreatLocker; Orlando (FL); On-site; USD 95,000 - 135,000; Full time

Job summary

ThreatLocker in Orlando, FL is seeking a Detection Engineer to drive the development and continuous improvement of detection content within the ThreatLocker Detect platform. You will create and maintain detection rules used by our EDR and ITDR products while ensuring alignment with the MITRE ATT&CK Framework.

You will develop custom Sigma, YARA, and Snort detections, map detections to MITRE ATT&CK, and continuously improve coverage.

Qualifications

• 3+ years in Information Security.
• 2+ years with EDR/ITDR technologies in an enterprise environment.
• Experience developing detection content is strongly preferred.
• Strong understanding of MITRE ATT\&CK Framework and its application in enterprise security.
• Experience creating Sigma, YARA, and Snort detection rules.
• Strong knowledge of Windows OS and forensic artifacts.
• Experience with Windows persistence, privilege escalation, defense evasion, and parent–child process relationships.
• Familiarity with malware analysis, threat hunting, and vulnerability research.
• Adversary emulation and post‑exploitation frameworks familiarity.
• Excellent written and verbal communication; ability to explain technical concepts to non‑technical stakeholders.

Responsibilities

• Create, test, and maintain detection content for ThreatLocker Detect platforms.
• Develop custom Sigma, YARA, and Snort detection rules.
• Map detections to MITRE ATT&CK and improve coverage.
• Analyze Windows telemetry and forensic artifacts to identify detection opportunities.
• Research attacker techniques including persistence, privilege escalation, defense evasion, and post‑exploitation activity.
• Collaborate with Threat Analysts and Security Researchers to remediate gaps.
• Validate detection logic through threat hunting, malware analysis, and adversary emulation.
• Tune detection content to improve accuracy and reduce false positives.
• Document detection methodologies and findings for internal teams.
• Stay current on emerging threats and industry best practices.

Skills

EDR/ITDR experience

Threat hunting

Malware analysis

Communication skills

Independent work

Education

OSCP

GCFA

GCIH

GCIA

GCDA

GCTD

GISP

Tools

Sigma

YARA

Snort

MITRE ATT&CK knowledge

Job description

ThreatLocker in Orlando, FL is seeking a Detection Engineer to drive the development and continuous improvement of detection content within the ThreatLocker Detect platform. You will create and maintain detection rules used by our EDR and ITDR products while ensuring alignment with the MITRE ATT&CK Framework.

You will develop custom Sigma, YARA, and Snort detections, map detections to MITRE ATT&CK, and continuously improve coverage.