Detection Engineering Lead - AI-Driven Security Content

Cisco Systems; Boulder (CO); Hybrid; USD 151,000 - 191,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) matching

Paid parental leave

Disability coverage

Life insurance

Job summary

Cisco Systems is seeking a Security Engineer in a hybrid role to design scalable detection content and data pipelines for enterprise protection. You will collaborate across SOC, IR, threat intel, and product teams to strengthen detection coverage and incident response capabilities.

The role emphasizes applying AI/ML techniques to reduce false positives and accelerate content development, while mentoring junior engineers and delivering clear runbooks and documentation.

Qualifications

• Bachelor’s degree plus 8 years of related experience, or Master’s degree with 6+ years, or PhD with 3+ years in Security Engineer/Detection Engineer roles.
• Deployed and maintained Splunk Enterprise Security content in a production SOC environment.
• Built detection queries in SPL at scale with risk-based alerting and baselining.
• Integrated AI/ML techniques (e.g., anomaly detection or LLM-assisted workflows) into detection pipelines to reduce false positives and accelerate content development.
• Translated threat intelligence into detection requirements with defined coverage metrics and measurable success criteria.

Responsibilities

• Design and build scalable detection content and data pipelines for high-volume security telemetry.
• Collaborate with incident response, SOC, and threat intelligence teams to close detection gaps.
• Mentor team members on detection standards and design patterns.
• Partner with SOC, IR, threat intel, and product teams to drive multi-functional detection initiatives.
• Utilize AI/ML techniques to improve detection quality and reduce manual toil.
• Produce technical documentation, runbooks, and presentations for engineering and security stakeholders.

Education

Bachelor’s degree

Master’s degree

PhD

Tools

GitHub/GitLab/Bitbucket

Python

SPL

Job description

Cisco Systems is seeking a Security Engineer in a hybrid role to design scalable detection content and data pipelines for enterprise protection. You will collaborate across SOC, IR, threat intel, and product teams to strengthen detection coverage and incident response capabilities.

The role emphasizes applying AI/ML techniques to reduce false positives and accelerate content development, while mentoring junior engineers and delivering clear runbooks and documentation.