Lead Threat Detection Engineer - Automation & SIEM

McKesson’s Corporate; Irving, Winslow Township (TX, NJ); On-site; USD 139,000 - 232,000; Full time

Job summary

McKesson is seeking a Lead Threat Detection Engineer to advance automated detection capabilities within a global security team. You will help mature Detection-as-Code, design detection content, and ensure scalable alert performance across our stack.

The role requires extensive experience in threat monitoring, rule writing, and SIEM tooling, plus collaboration with Intel, SOC, and Red Teams to improve coverage and reduce risk to McKesson operations.

Qualifications

• 10+ years of professional experience in detection engineering or related fields.
• Strong knowledge of threat actors, TTPs, and security operations.
• Experience with rule writing and alert tuning to reduce false positives.

Responsibilities

• Mature detection from manual to automated, Detection-as-Code.
• Develop use-cases from intel, red team findings, and incident data.
• Write detection and correlation rules across our stack.
• Onboard logs and identify gaps in data for alerts.
• Collaborate with Intel, SOC, and Red Teams to improve coverage.

Skills

Detection engineering

Rule development

Python scripting

Threat intelligence

Cross-team collaboration

Education

Bachelor’s degree in Computer Science, Information Security, Security Engineering, Statistics, or Data Science

Tools

Splunk SPL

SIEM

Job description

McKesson is seeking a Lead Threat Detection Engineer to advance automated detection capabilities within a global security team. You will help mature Detection-as-Code, design detection content, and ensure scalable alert performance across our stack.

The role requires extensive experience in threat monitoring, rule writing, and SIEM tooling, plus collaboration with Intel, SOC, and Red Teams to improve coverage and reduce risk to McKesson operations.