Lead Detection Engineer, Endpoint ML & SIEM Automation

Jobtailor; New York (NY); On-site; USD 120,000 - 180,000; Full time

Job summary

Jobtailor in New York seeks a senior Detection Engineer to own end-to-end endpoint threat detection, leveraging telemetry, ML, and GenAI-assisted workflows to reduce false positives and accelerate development.

You will design detections on MITRE ATT&CK, mentor engineers, ensure fintech compliance, and collaborate with CSOC, Threat Intelligence, and CI/CD teams to operationalize across the enterprise SIEM.

Qualifications

• Must have 4+ years in cybersecurity or IT.
• 4+ years of experience with endpoint logs (Windows Event Logs, Sysmon, EDR telemetry).
• 2+ years with EDR platforms (CrowdStrike Falcon, SentinelOne, or Microsoft Defender).
• 4+ years of alert development for threat detection.

Responsibilities

• Own end-to-end detection coverage for the Endpoint domain from telemetry requirements to high-fidelity alert deployment.
• Leverage LLMs and ML to automate detection logic, summarize attack chains, reduce false positives, and accelerate detection development.
• Lead the design, development, and maintenance of Detection-as-Code rules using GenAI-assisted workflows and CI/CD pipelines.
• Design and build behavioral detections identifying adversary patterns, TTPs, and anomalous endpoint activity.
• Use MITRE ATT&CK to visualize, prioritize, and close endpoint coverage gaps.
• Mentor engineers on security concepts, AI-driven workflows, and detection engineering best practices.

Skills

Endpoint security expertise

Threat detection development

Machine learning in security

Mentoring

Communication

Education

Bachelor's Degree

Tools

CrowdStrike Falcon

SentinelOne

Microsoft Defender

Databricks

Apache Spark

CI/CD workflows

YAML-based detection frameworks

Job description

Jobtailor in New York seeks a senior Detection Engineer to own end-to-end endpoint threat detection, leveraging telemetry, ML, and GenAI-assisted workflows to reduce false positives and accelerate development.

You will design detections on MITRE ATT&CK, mentor engineers, ensure fintech compliance, and collaborate with CSOC, Threat Intelligence, and CI/CD teams to operationalize across the enterprise SIEM.