Detection Engineer: EDR/ITDR & MITRE Mapping

Threatlocker Inc; Orlando (FL); On-site; USD 90,000 - 150,000; Full time

Job summary

ThreatLocker is seeking a Detection Engineer to drive the development and improvement of detection content within the ThreatLocker Detect platform. The role involves creating and maintaining detection rules for EDR and ITDR products, with alignment to the MITRE ATT&CK framework.

You will leverage telemetry from malware analysis, vulnerability research, and proactive threat hunting to identify detection gaps and improve coverage.

Qualifications

• 3+ years of information security experience.
• 2+ years with EDR/ITDR in enterprise environments.
• Experience developing detection content preferred.
• Strong knowledge of MITRE ATT&CK and its enterprise use.
• Experience creating Sigma, YARA, and Snort detection rules.
• Strong knowledge of Windows OS and forensic artifacts.

Responsibilities

• Develop, test, and maintain detection content for ThreatLocker platforms.
• Create and maintain Sigma, YARA, and Snort detection rules.
• Map detections to the MITRE ATT&CK Framework and improve coverage.
• Analyze Windows telemetry and forensic artifacts to identify detection opportunities.
• Research attacker techniques including persistence, privilege escalation, defense evasion, and post-exploitation.
• Collaborate with Threat Analysts and Security Researchers to remediate detection gaps.

Skills

EDR/ITDR

MITRE ATT&CK

Windows forensics

Threat hunting

Adversary emulation

Communication

Tools

Sigma rules

YARA rules

Snort rules

Job description

ThreatLocker is seeking a Detection Engineer to drive the development and improvement of detection content within the ThreatLocker Detect platform. The role involves creating and maintaining detection rules for EDR and ITDR products, with alignment to the MITRE ATT&CK framework.

You will leverage telemetry from malware analysis, vulnerability research, and proactive threat hunting to identify detection gaps and improve coverage.