Detection & Response Engineer — Threat Hunting & SIEM Pro

Coalfire; United States; Hybrid; USD 120,000 - 150,000; Full time

Benefits offered by this job

Flexible work model

Certification reimbursement

Comprehensive insurance options

Parental leave & wellbeing programs

Job summary

Coalfire is seeking a Detection and Response Engineer to join our Defensive Services team, supporting SIEM monitoring, threat hunting, and purple team activities. You will drive proactive detection improvements and map incidents to MITRE ATT&CK, while collaborating with client environments to meet federal and commercial security needs.

You will develop detection queries across SIEM platforms, optimize alerts, and build dashboards to enable repeatable use cases.

Qualifications

• Experience in detection and response in large security environments.
• Hands-on with multiple SIEM platforms and threat hunting.
• Ability to map MITRE ATT&CK to incidents and runbooks.
• Familiarity with FedRAMP, FISMA, HIPAA, HITRUST, PCI standards.

Responsibilities

• Collect, analyze, and operationalize threat intelligence to drive detection and threat-hunting improvements.
• Develop and tune detection queries across SIEM platforms and build dashboards and searches.
• Lead hypothesis-driven threat hunts and translate outcomes into detections and runbooks.
• Investigate and respond to alerts with clear timelines and evidence.

Skills

Threat intelligence

Threat hunting

SIEM monitoring

Incident response

Communication

Documentation

Collaboration

Education

Bachelor-level degree or equal

Tools

Splunk

Microsoft Sentinel

ELK

Sumo Logic

Threat intel platforms

Job description

Coalfire is seeking a Detection and Response Engineer to join our Defensive Services team, supporting SIEM monitoring, threat hunting, and purple team activities. You will drive proactive detection improvements and map incidents to MITRE ATT&CK, while collaborating with client environments to meet federal and commercial security needs.

You will develop detection queries across SIEM platforms, optimize alerts, and build dashboards to enable repeatable use cases.