Lead Detection Engineer – AI-Powered Security

Cisco; Dallas (TX); Hybrid; USD 151,000 - 191,000; Full time

Benefits offered by this job

Hybrid work model

Annual bonuses

Restricted stock units (RSUs)

Job summary

Cisco is seeking a high-caliber Security Engineer in the Detection Engineering team to secure the Splunk portfolio. You will design scalable detection content, partner with incident response, and mentor peers on detection standards and patterns.

This hybrid role emphasizes building detection systems and data pipelines to transform telemetry into actionable alerts for triage. You will leverage AI/ML techniques to reduce false positives, implement risk-based alerting, and drive detection coverage

Qualifications

• Bachelor’s + 8 years of related experience or a Master’s degree with 6+ years of related experience, or a PhD + 3 years of related experience as a Security Engineer, Detection Engineer, Security Content Developer, SOC Analyst, or Security Operations professional
• Deployed and maintained Splunk Enterprise Security content in a production SOC environment, including detections, data models, and data management
• Built detection queries in SPL at scale, including risk-based alerting, statistical baselining, and optimized searches across high-volume data sources
• Integrated AI/ML techniques (e.g., anomaly detection, LLM-assisted workflows) into detection engineering pipelines to reduce false positive rates and accelerate content development
• Translated threat intelligence and ATT&CK-mapped adversary behaviors into detection requirements with defined coverage metrics and measurable success criteria

Skills

Splunk ES experience

SPL queries

AI/ML in detection

Threat intelligence mapping

Security operations

Education

Bachelor’s degree in a related field

Master’s degree in related field

PhD in related field

Tools

GitHub

GitLab

Bitbucket

CloudTrail

Azure Monitor

GCS audit logs

SPL tooling

Job description

Cisco is seeking a high-caliber Security Engineer in the Detection Engineering team to secure the Splunk portfolio. You will design scalable detection content, partner with incident response, and mentor peers on detection standards and patterns.

This hybrid role emphasizes building detection systems and data pipelines to transform telemetry into actionable alerts for triage. You will leverage AI/ML techniques to reduce false positives, implement risk-based alerting, and drive detection coverage