Detection Engineer (EDR/ITDR) - MITRE Mapping

SKY VC; Orlando, Northern (FL, KY); Hybrid; USD 110,000 - 140,000; Full time

Job summary

ThreatLocker is seeking a Detection Engineer to develop and improve detection content for the ThreatLocker Detect platform in an in-office Orlando role. You will create and maintain custom Sigma, YARA, and Snort rules and map detections to the MITRE ATT&CK framework.

Work with Threat Analysts and Security Researchers to identify gaps, validate logic through threat hunting and malware analysis, and stay current on emerging threats and best practices. This position is based in Orlando, FL.

Qualifications

• 3+ years of information security experience.
• 2+ years with EDR/ITDR technologies in enterprise environments.
• Experience developing detection content is strongly preferred.
• Strong understanding of MITRE ATT&CK and its enterprise application.
• Experience creating custom Sigma, YARA, and Snort rules.
• Strong knowledge of Windows OS and forensic artifacts.
• Familiarity with threat hunting, vulnerability research, and adversary emulation.

Responsibilities

• Develop, test, and maintain detection content for ThreatLocker Detect platform.
• Create and maintain Sigma, YARA, and Snort detection rules.
• Map detections to MITRE ATT&CK framework and improve coverage.
• Analyze Windows telemetry and artifacts to identify opportunities.
• Collaborate with Threat Analysts and Researchers to remediate gaps.
• Validate detection logic via threat hunting and malware analysis.
• Document methodologies and findings for internal teams.

Skills

EDR/ITDR

MITRE ATT&CK

Analytical thinking

Threat hunting

Communication

Tools

Sigma

YARA

Snort

Job description

ThreatLocker is seeking a Detection Engineer to develop and improve detection content for the ThreatLocker Detect platform in an in-office Orlando role. You will create and maintain custom Sigma, YARA, and Snort rules and map detections to the MITRE ATT&CK framework.

Work with Threat Analysts and Security Researchers to identify gaps, validate logic through threat hunting and malware analysis, and stay current on emerging threats and best practices. This position is based in Orlando, FL.