Manager, Threat Detection Engineer

Jobtailor; Washington (District of Columbia); On-site; USD 140,000 - 190,000; Full time

Job summary

Jobtailor is seeking an experienced Threat Detection Engineer to own end-to-end detection engineering and threat intelligence workflows. You will develop production-ready detections across multiple domains and drive improvements through AI-assisted tooling.

In this role, you will collaborate with incident response, engineering, and security teams to translate adversary behavior into prioritized detections, testing, and operational adoption.

Qualifications

• Bachelor's degree required; cybersecurity, computer science, information systems, engineering, or related concentration strongly preferred, or equivalent relevant professional experience
• Advanced degree in a related discipline preferred
• 5–7 years of relevant information-security or cybersecurity experience
• 4+ years of hands-on experience spanning threat detection engineering and cyber threat intelligence
• Experience developing production detections and using intelligence to improve detection, hunting, or response
• Experience owning complex security processes or services and leading cross-functional technical initiatives through measurable operational adoption
• Hands-on experience creating, testing, deploying, and tuning production detection logic via structured query, rule, or analytic language
• Experience with security telemetry from multiple domains and diagnosing data-quality or schema issues affecting detection outcomes
• Experience developing automation with a general-purpose programming language
• Experience integrating systems through APIs, structured data formats, and version-controlled workflows
• Demonstrated use of AI-assisted or analytical techniques in a production security workflow, including testing generated content and measuring results
• Deep knowledge of adversary behavior, detection engineering methods, and practical MITRE ATT&CK use
• Working knowledge of SIEM, EDR/XDR, SOAR, threat intelligence, case-management, and digital-risk capabilities
• Strong understanding of detection testing, data validation, alert fidelity, false-positive reduction, lifecycle governance, intelligence standards, indicator confidence, and aging
• Ability to write technical requirements, detection documentation, intelligence assessments, executive summaries, operating procedures, and recommendations
• Ability to review technical work, coach others, and improve team practices without formal reporting authority
• Relevant certifications are preferred
• Experience with cloud security telemetry and controls, dark-web analysis, domain impersonation, executive-protection digital risk, takedown coordination, or multiple detection languages is preferred
• Examples of detection languages include Sigma, KQL, SPL, XQL, YARA-L, EQL, SQL, and YARA

Responsibilities

• Own the detection content lifecycle from requirements and design through testing, deployment, tuning, and retirement
• Develop high-fidelity detections across endpoint, identity, email, network, cloud, and business-critical application telemetry
• Translate adversary behaviors, threat intelligence, incident learnings, and control gaps into production-ready analytics
• Coordinate targeted threat hunts with incident response and security partners
• Review technical work, establish reusable standards, and coach contributors
• Manage intelligence requirements and produce strategic, operational, and tactical intelligence assessments and briefings
• Turn intelligence into prioritized detection, hunting, hardening, and response requirements
• Govern indicator and intelligence-data lifecycles and maintain information-sharing relationships
• Coordinate monitoring for dark-web activity, lookalike domains, social-media threats, impersonation, exposed information, and other digital risks
• Support executive protection with cyber and digital-risk intelligence
• Work with Legal, Communications, service providers, and business stakeholders on assessments, escalations, and takedowns
• Use AI-assisted and analytical tools to develop, translate, test, and document detection rules
• Build and maintain automation playbooks for alert enrichment, evidence correlation, investigation summaries, prioritization, routing, and recommendations
• Develop scripts, integrations, and data transformations connecting detection, intelligence, case-management, and response workflows
• Pilot workflow changes, train affected analysts, and measure adoption, investigation time, quality, and rework
• Improve telemetry coverage, data quality, integration reliability, scalability, and cost effectiveness
• Translate the Threat Detection and Intelligence strategy into an actionable roadmap and prioritized backlog
• Build partnerships across incident response, vulnerability management, engineering, infrastructure, cloud, identity, and Communications
• Define operating handoffs, ownership boundaries, and escalation paths
• Present metrics, risks, recommendations, and progress updates to technical and non-technical audiences
• Monitor service-provider performance and resolve delivery, handoff, and escalation issues

Skills

Threat Detection Engineering

Cyber Threat Intelligence

Production Detection Logic Development

Automation Development

MITRE ATT&CK

Education

Bachelor's degree in cybersecurity or related field

Advanced degree preferred

Tools

SIEM

EDR/XDR

SOAR

Job description

• Own the detection content lifecycle from requirements and design through testing, deployment, tuning, and retirement
• Develop high-fidelity detections across endpoint, identity, email, network, cloud, and business-critical application telemetry
• Translate adversary behaviors, threat intelligence, incident learnings, and control gaps into production-ready analytics
• Coordinate targeted threat hunts with incident response and security partners
• Review technical work, establish reusable standards, and coach contributors
• Manage intelligence requirements and produce strategic, operational, and tactical intelligence assessments and briefings
• Turn intelligence into prioritized detection, hunting, hardening, and response requirements
• Govern indicator and intelligence-data lifecycles and maintain information-sharing relationships
• Coordinate monitoring for dark-web activity, lookalike domains, social-media threats, impersonation, exposed information, and other digital risks
• Support executive protection with cyber and digital-risk intelligence
• Work with Legal, Communications, service providers, and business stakeholders on assessments, escalations, and takedowns
• Use AI-assisted and analytical tools to develop, translate, test, and document detection rules
• Build and maintain automation playbooks for alert enrichment, evidence correlation, investigation summaries, prioritization, routing, and recommendations
• Develop scripts, integrations, and data transformations connecting detection, intelligence, case-management, and response workflows
• Pilot workflow changes, train affected analysts, and measure adoption, investigation time, quality, and rework
• Improve telemetry coverage, data quality, integration reliability, scalability, and cost effectiveness
• Translate the Threat Detection and Intelligence strategy into an actionable roadmap and prioritized backlog
• Build partnerships across incident response, vulnerability management, engineering, infrastructure, cloud, identity, and Communications
• Define operating handoffs, ownership boundaries, and escalation paths
• Present metrics, risks, recommendations, and progress updates to technical and non-technical audiences
• Monitor service-provider performance and resolve delivery, handoff, and escalation issues

Requirements

• Bachelor's degree required; cybersecurity, computer science, information systems, engineering, or related concentration strongly preferred, or equivalent relevant professional experience
• Advanced degree in a related discipline preferred
• 5–7 years of relevant information-security or cybersecurity experience
• 4+ years of hands-on experience spanning threat detection engineering and cyber threat intelligence
• Experience developing production detections and using intelligence to improve detection, hunting, or response
• Experience owning complex security processes or services and leading cross-functional technical initiatives through measurable operational adoption
• Hands-on experience creating, testing, deploying, and tuning production detection logic via structured query, rule, or analytic language
• Experience with security telemetry from multiple domains and diagnosing data-quality or schema issues affecting detection outcomes
• Experience developing automation with a general-purpose programming language
• Experience integrating systems through APIs, structured data formats, and version-controlled workflows
• Demonstrated use of AI-assisted or analytical techniques in a production security workflow, including testing generated content and measuring results
• Deep knowledge of adversary behavior, detection engineering methods, and practical MITRE ATT&CK use
• Working knowledge of SIEM, EDR/XDR, SOAR, threat intelligence, case-management, and digital-risk capabilities
• Strong understanding of detection testing, data validation, alert fidelity, false-positive reduction, lifecycle governance, intelligence standards, indicator confidence, and aging
• Ability to write technical requirements, detection documentation, intelligence assessments, executive summaries, operating procedures, and recommendations
• Ability to review technical work, coach others, and improve team practices without formal reporting authority
• Relevant certifications are preferred
• Experience with cloud security telemetry and controls, dark-web analysis, domain impersonation, executive-protection digital risk, takedown coordination, or multiple detection languages is preferred or strongly preferred
• Examples of detection languages include Sigma, KQL, SPL, XQL, YARA-L, EQL, SQL, and YARA

Core Competencies

Demonstrates expertise in threat detection engineering, cyber threat intelligence, and the development of production-ready detection logic. Proficient in managing complex security processes, integrating systems, and utilizing AI-assisted tools to enhance detection and response capabilities.

Highest-signal resume keywords

• Threat Detection Engineering
• Cyber Threat Intelligence
• Production Detection Logic Development
• Automation Development
• SIEM/EDR/XDR Knowledge

ATS Optimization Keywords

Hard Skills

• Detection Logic Development
• Structured Query Language
• Analytic Language Proficiency
• Automation Scripting
• Data Quality Diagnosis
• Threat Intelligence Analysis
• Detection Testing
• Incident Response Coordination
• Adversary Behavior Analysis
• MITRE ATT&CK Framework

Soft Skills

• Coaching
• Technical Documentation
• Cross-Functional Collaboration
• Communication Skills
• Problem-Solving

Certifications & Qualifications

• Relevant Cybersecurity Certifications

Industry Keywords

• Cybersecurity
• Information Security
• Threat Detection
• Digital Risk
• Dark-Web Analysis
• Domain Impersonation
• Executive Protection

Tools & Technologies

• SIEM
• EDR/XDR
• SOAR
• APIs
• AI-Assisted Tools
• Digital-Risk Capabilities
• Case-Management Systems
• Cloud Security Telemetry