Detection Engineer III

OU Health; Oklahoma City (OK); On-site; USD 110,000 - 140,000; Full time

Benefits offered by this job

PTO

401(k)

Medical and dental plans

Job summary

OU Health is seeking a Detection Engineer III to lead the development of advanced detection capabilities defending against sophisticated cyber threats. You will design detection frameworks, craft robust rules, and guide behavioral analytics across cloud, hybrid, and on‑prem environments.

You will perform proactive threat hunting, reverse‑engineer malware, and mentor teams to elevate capabilities. Collaboration with IT, DevOps, and threat intelligence will shape defense strategies and incident

Qualifications

• Expertise in developing, testing and fine‑tuning detection rules and signatures for tools such as SIEM, IDS/IPS and EDR platforms to detect malicious activities and anomalies.
• Expertise in conducting proactive threat hunting using advanced techniques and tools to identify hidden threats, unknown vulnerabilities and anomalous behavior across networks and endpoints.
• Expert knowledge of scripting languages (Python, PowerShell, Bash, etc.) to automate detection workflows, data collection and analysis processes, enhancing the efficiency and accuracy of threat detection.
• Expertise in analyzing large volumes of security data, including log files and network traffic and correlating disparate data sources to identify patterns indicative of malicious activity.
• Expert knowledge of adversary TTPs and frameworks like MITRE ATT&CK to develop and refine detection capabilities tailored to specific threat scenarios and attack vectors.
• Expert proficiency in Python, PowerShell, or Bash for developing detection scripts, automating repetitive tasks, and integrating tools within the security stack.
• Expertise in using SQL, regular expressions, and custom query languages to search, filter, and analyze large datasets for potential threats.
• Expertise in developing and managing detection content libraries, including playbooks, runbooks, and detection use cases tailored to organizational risks.
• Continuous research and learning to stay current with emerging threats, detection methodologies, and adversary behaviors to enhance detection capabilities.
• Ability to coach, guide and mentor team members.

Responsibilities

• Lead Detection Engineering Development to design and implement advanced detection frameworks against persistent threats.
• Create Robust Detection Rules and Models for cloud, hybrid, and on‑prem infrastructures.
• Leverage Industry‑Leading Tools like SIEM, EDR, and custom solutions to improve detection accuracy.
• Analyze Attacker TTPs to inform detection strategies and threat identification.
• Conduct Proactive Threat Hunting to uncover hidden threats using hypothesis‑driven techniques.
• Perform Advanced Malware Analysis to reverse‑engineer malware and provide mitigation guidance.
• Enhance Incident Response Readiness by refining processes and aligning outputs with remediation efforts.
• Establish and Refine Best Practices for detection engineering.
• Mentor and Develop Team Capabilities to elevate skills across the group.
• Collaborate Across Functional Teams to align detection with broader security strategies.
• Contribute to Security Strategy and Innovation by driving detection improvements and thought leadership.
• Develop Strategic Documentation and Reporting including playbooks and technical communications.

Skills

Threat hunting

MITRE ATT&CK

Python scripting

SIEM/EDR expertise

Threat modeling

Incident response

Malware analysis

Mentoring/leadership

Cross-functional collaboration

Detection frameworks

Education

Bachelor's Degree

Tools

Splunk

QRadar

Elastic Stack

Zeek

Suricata

Job description

The Detection Engineer III is a subject matter expert which will lead the development of cutting‑edge detection capabilities to defend against the most advanced and persistent cyber threats. You will design and implement highly sophisticated detection frameworks, leveraging deep knowledge of attacker tactics, techniques, and procedures (TTPs) as well as industry‑leading tools such as SIEM, EDR, and custom‑built solutions.

Your expertise will drive the creation of robust detection rules, threat models, and behavioral analytics that span diverse environments, including cloud, hybrid, and on‑premises infrastructures. In addition to leading proactive threat hunting initiatives, you will perform advanced analysis of malicious artifacts, reverse‑engineer malware, and provide guidance on mitigating emerging threats.

In this strategic role, you will collaborate with cross‑functional teams to align detection engineering with organizational security objectives. You will also establish best practices, refine detection processes, and mentor teams to elevate their technical capabilities. As a recognized expert, you will influence organizational security strategy, enhance incident response capabilities, and contribute to the industry through thought leadership and innovation.

Essential Responsibilities

• Lead Detection Engineering Development. Design and implement advanced detection frameworks and capabilities to defend against persistent and sophisticated cyber threats.

• Create Robust Detection Rules and Models. Develop and optimize detection rules, threat models, and behavioral analytics for diverse environments, including cloud, hybrid, and on‑premises infrastructures.

• Leverage Industry-Leading Tools. Utilize tools such as SIEM, EDR, and custom‑built solutions to enhance detection accuracy and efficiency across complex infrastructures.

• Analyze Attacker Tactics and Techniques. Apply in‑depth knowledge of attacker TTPs to inform detection strategies and improve threat identification and mitigation processes.

• Conduct Proactive Threat Hunting. Lead proactive threat hunting initiatives to uncover hidden threats and vulnerabilities using hypothesis‑driven techniques and behavioral analysis.

• Perform Advanced Malware Analysis. Reverse‑engineer malware, analyze malicious artifacts, and provide actionable guidance to mitigate and respond to emerging threats.

• Enhance Incident Response Readiness. Collaborate with incident response teams to refine processes, improve response capabilities, and align detection outputs with remediation efforts.

• Establish and Refine Best Practices. Develop and implement best practices for detection engineering, ensuring alignment with organizational security objectives and industry standards.

• Mentor and Develop Team Capabilities. Provide technical mentorship and guidance to elevate the skills of team members and foster a culture of continuous improvement.

• Collaborate Across Functional Teams. Partner with cross‑functional teams, including IT, DevOps, and threat intelligence, to align detection capabilities with broader security strategies.

• Contribute to Security Strategy and Innovation. Influence organizational security strategies by driving innovation in detection capabilities and contributing thought leadership within the industry.

• Develop Strategic Documentation and Reporting. Create detailed documentation of detection frameworks, methodologies, and playbooks, and provide strategic insights through technical reporting and communication with stakeholders.

General Responsibilities

• Performs other duties as assigned.

Minimum Qualifications

Education Requirements: Bachelor's Degree required.

Experience Requirements:

• 5 or more years of experience as a Cybersecurity Engineer required.

• 7 or more years of relevant IT experience required.

License/Certification/Registration Requirements

• Upper tier security or Cybersecurity Operations certification (e.g. CISSP, GSEC, or CISM) required or obtained within 36 months from hire date.

• Other industry certifications in Cybersecurity Operations or IT security (e.g. GIAC) are highly desirable.

Knowledge/Skills/Abilities Required:

• Expertise in developing, testing and fine‑tuning detection rules and signatures for tools such as SIEM, IDS/IPS and EDR platforms to detect malicious activities and anomalies.

• Expertise in conducting proactive threat hunting using advanced techniques and tools to identify hidden threats, unknown vulnerabilities and anomalous behavior across networks and endpoints.

• Expert knowledge of scripting languages (Python, PowerShell, Bash, etc.) to automate detection workflows, data collection and analysis processes, enhancing the efficiency and accuracy of threat detection.

• Expertise in analyzing large volumes of security data, including log files and network traffic and correlating disparate data sources to identify patter indicative of malicious activity.

• Expert knowledge of adversary TTPs and frameworks like MITRE ATT&CK to develop and refine detection capabilities tailored to specific threat scenarios and attack vectors.

• Expertise in configuring, tuning, and managing SIEM tools (e.g., Splunk, QRadar, Elastic Stack) and network monitoring tools (e.g., Zeek, Suricata).

• Expert ability to develop and refine detection rules, signatures, and alerts for IDS/IPS, EDR, and SIEM systems based on emerging threats and attack patterns.

• Expert skills in conducting proactive threat hunting using hypothesis‑driven investigations and identifying anomalies in network traffic, logs, and endpoint activity.

• Expertise integrating CTI feeds with detection tools, enriching alert context, and correlating threat intelligence with internal security events.

• Expert proficiency in Python, PowerShell, or Bash for developing detection scripts, automating repetitive tasks, and integrating tools within the security stack.

• Expertise in using SQL, regular expressions, and custom query languages (e.g., SPL for Splunk) to search, filter, and analyze large datasets for potential threats.

• Expertise in developing and managing detection content libraries, including playbooks, runbooks, and detection use cases tailored to organizational risks.

• Continuous research and learning to stay current with emerging threats, detection methodologies, and adversary behaviors to enhance detection capabilities.

• Ability to coach, guide and mentor team members.

OU Health is an equal opportunity employer. We offer a comprehensive benefits package, including PTO, 401(k), medical and dental plans, and many more. We know that a total benefits and compensation package, designed to meet your specific needs both inside and outside of the work environment, create peace of mind for you and your family.