Endpoint Detection Engineering Manager

Capital One; McLean (VA); On-site; USD 197,000 - 225,000; Full time

Job summary

Capital One’s Cyber Organization seeks an experienced Detection Engineer to own end-to-end detection for the Endpoint domain. You will design, develop, and tune high-fidelity detections across Windows, Linux, and macOS telemetry, aligning with MITRE ATT&CK.

The role emphasizes Detection-as-Code, AI-assisted workflows, and collaboration with CSOC and Cyber Threat Intelligence to strengthen enterprise security.

Qualifications

• High School Diploma or equivalent
• At least 4 years of experience in cybersecurity or information technology
• At least 4 years of experience with endpoint and host logs (Windows Event Logs, Sysmon, EDR telemetry)
• At least 2 years of experience with EDR platforms (CrowdStrike Falcon, SentinelOne, Microsoft Defender)
• At least 4 years of experience developing alerts for threat detection
• At least 2 years of experience with penetration testing, offensive security, or adversary emulation
• At least 1 year of experience with machine learning or data science applied to security

Responsibilities

• Own end-to-end detection coverage for the Endpoint threat surface — managing telemetry onboarding, alert deployment, tuning, and gap analysis.
• Design, develop, and maintain detection rules using Detection-as-Code methodologies and CI/CD pipelines.
• Apply MITRE ATT&CK framework to visualize and close coverage gaps, balancing fidelity and operational risk.
• Translate attacker techniques into high-fidelity detections and proactively identify coverage gaps.
• Mentor engineers and contribute to a culture of continuous improvement across the team.

Skills

Endpoint security

EDR platforms

Telemetry analysis

Windows

Linux

macOS

Threat detection

SQL

ML concepts

Education

Bachelor's Degree

High School Diploma

Tools

CrowdStrike Falcon

SentinelOne

Microsoft Defender

GitHub

CI/CD

Job description

Capital One’s Cyber Organization seeks an experienced Detection Engineer to own end-to-end detection for the Endpoint domain. You will design, develop, and tune high-fidelity detections across Windows, Linux, and macOS telemetry, aligning with MITRE ATT&CK.

The role emphasizes Detection-as-Code, AI-assisted workflows, and collaboration with CSOC and Cyber Threat Intelligence to strengthen enterprise security.