Detection Engineer & Threat Hunter — SIEM/EDR Automation

TikTok; San Jose (CA); On-site; USD 112,000 - 223,000; Full time

Job summary

TikTok is seeking an experienced security operations professional for its San Jose, CA team to strengthen enterprise IT cyber security, server and endpoint protection, and application security practices. You will work on security assessments, operations, and vulnerability management, while supporting IT and business units in meeting security requirements.

Responsibilities include monitoring alerts from SIEM/EDR, building detections across multiple telemetry sources, reducing false positives, and

Qualifications

• 4+ years in security operations, incident response, detection engineering, or threat hunting.
• Experience with SIEM platforms and EDR tools.
• Hands-on with detection logic and threat hunting practices.
• Understanding attacker tactics and MITRE ATT&CK framework.
• Scripting ability in Python or similar for automation.

Responsibilities

• Monitor security alerts from SIEM/EDR and other tools.
• Build and tune high-fidelity detections across telemetry sources.
• Reduce alert fatigue with improved tagging and enrichment.
• Conduct threat hunting based on TTPs and threat intel.
• Design and maintain SOAR playbooks for triage and response.
• Collaborate with CTI and detection engineers to operationalize intel.
• Develop detection logic aligned with MITRE ATT&CK and MaGMa.
• Contribute scripts to improve investigation and response efficiency.
• This role requires on-call shifts and potential holiday work.
• Assist in post-incident reviews and continuous improvement.

Skills

Security operations

Incident response

Detection engineering

Threat hunting

MITRE ATT&CK knowledge

Python scripting

Logs from identity, endpoints, cloud,

Education

Bachelor's degree in Computer Science, Cyber Security, or STEM

Tools

Splunk

Chronicle

Elastic

SentinelOne

CrowdStrike

Sigma

EQL

KQL

YARA

Job description

TikTok is seeking an experienced security operations professional for its San Jose, CA team to strengthen enterprise IT cyber security, server and endpoint protection, and application security practices. You will work on security assessments, operations, and vulnerability management, while supporting IT and business units in meeting security requirements.

Responsibilities include monitoring alerts from SIEM/EDR, building detections across multiple telemetry sources, reducing false positives, and