Remote Senior Threat Detection & Response Engineer

REI; Seattle (WA); Hybrid; USD 130,000 - 208,000; Full time

Benefits offered by this job

Employee discount

Health benefits

Retirement plan

Paid time off

Job summary

REI is hiring a Senior Detection Engineer on our Security Operations team in Seattle. You will build and tune alerts across SIEM/EDR, hunt threats, and help review security events.

You’ll use scripting and automation to speed incident response and collaborate with analysts, engineers, data teams, and business partners. The role covers devices, user access, networks, cloud tools, and AI data use, with on-call rotation and remote eligibility.

Qualifications

• Bachelor's degree in CS/IS/IT or related field.
• 5+ years in security operations, detection engineering, or related roles.
• Experience creating and tuning alerts in SIEM (Splunk, Sentinel) and working with EDR tools.
• Ability to review threats across devices, networks, cloud tools, logs.
• Knowledge of MITRE ATT&CK and attacker TTPs.
• Scripting ability (Python or PowerShell) and cross-team collaboration.
• Willing to travel to Seattle HQ 1-2 times per year (remote eligible).

Responsibilities

• Build, test, and maintain threat alerts across SIEM/EDR/cloud tools.
• Tune alerts, reduce false positives, monitor event trends.
• Join threat hunts and incident reviews; help contain threats and root cause.
• Develop scripts, playbooks, and SOAR links to speed response.
• Collaborate with security, engineering, data, and business teams; participate in on-call as needed.

Skills

Security operations

Threat hunting

Incident response

Security engineering

Cross-functional collaboration

Education

Bachelor's degree in CS/IS/IT or related field

Tools

Splunk

Microsoft Sentinel

Microsoft Defender

CrowdStrike

SentinelOne

Python

PowerShell

Job description

REI is hiring a Senior Detection Engineer on our Security Operations team in Seattle. You will build and tune alerts across SIEM/EDR, hunt threats, and help review security events.

You’ll use scripting and automation to speed incident response and collaborate with analysts, engineers, data teams, and business partners. The role covers devices, user access, networks, cloud tools, and AI data use, with on-call rotation and remote eligibility.