Senior AI-Driven Detection Engineer (SIEM)

Procter & Gamble; United States; On-site; USD 110,000 - 165,000; Full time

Job summary

Procter & Gamble in Cincinnati is seeking a Senior Detection Engineer to join the InfoSec Cyber Defense Technology team. You will design, tune, and scale detection across enterprise SIEM platforms, combining traditional rules with agentic AI workflows to accelerate threat detection development and validation.

The role emphasizes collaboration with Threat Intelligence, Threat Hunting, and SOC teams, with hands-on work writing detection logic, managing content as code, and improving alert fidelity

Qualifications

• Required: Bachelor’s degree in Information Systems, Information Technology (IT), Computer Science, Engineering, or other technical / IT field and / or at least 5+ years of relevant experience in detection engineering, security operations, or threat detection roles
• Proven experience writing and tuning SIEM detection rules/analytics (correlation rules, scheduled queries, real‑time alerts)
• Strong understanding of MITRE ATT&CK framework and its application to detection coverage
• Proficiency in Python for automation, scripting, and tooling
• Experience with git-based workflows (branching, PRs, CI/CD) for managing security content
• Familiarity with security log sources: EDR, identity, cloud, network, proxy
• Preferred: CISSP, CCSP, OSCP, GCDA, GCIA; cloud & ML/AI certifications
• Experience with detection‑as‑code practices and YAML‑based rule formats (Sigma, custom schemas)
• Working knowledge of AI/LLM capabilities and their security implications
• Experience with MCP servers, GitHub Copilot, or other AI‑assisted development workflows
• Familiarity with SOAR platforms and their integration with detection pipelines
• Understanding of Kubernetes, cloud‑native architectures, and OT/ICS environments

Responsibilities

• Design, build, test, and tune detection rules mapped to MITRE ATT&CK, prioritized by threat intelligence and business risk
• Write detection logic across the SIEM and data lake platforms
• Manage detection content as code — Git-based workflows, PR reviews, CI/CD deployment pipelines
• Investigate and suppress false positives systematically using lookup‑based architectures
• Collaborate with Threat Hunting and Threat Intelligence teams through structured handover processes (TI→TH→DE pipeline)
• Monitor emerging threats and rapidly develop detections for new TTPs, CVEs, and active campaigns
• Leverage AI agents and LLM‑assisted workflows to accelerate detection rule development, validation, and coverage analysis
• Use and contribute to MCP tooling that enables AI‑assisted detection validation
• Operate agentic pipelines that triage large rule libraries against live telemetry at scale
• Apply AI/ML techniques where appropriate for anomaly detection, behavioral analytics, or pattern identification in security datasets
• Stay current on frontier AI threats and translate them into detection opportunities
• Work closely with SOC analysts to understand alert quality feedback and drive fidelity improvements
• Collaborate with data engineers on telemetry availability, data quality, and log source onboarding
• Contribute to detection coverage reporting and MITRE ATT&CK posture measurement
• Document detection logic, tuning rationale, and suppression decisions

Skills

Python

SIEM

Git workflows

CI/CD

Threat Hunting

Threat Intelligence

MITRE ATTACK

AI tooling

Kubernetes

MCP tooling

Education

Bachelor’s degree in Information Systems/IT/CS/Engineering

Tools

GitHub Copilot

Sigma

Sigma rules

MCP servers

SOAR platforms

Job description

Procter & Gamble in Cincinnati is seeking a Senior Detection Engineer to join the InfoSec Cyber Defense Technology team. You will design, tune, and scale detection across enterprise SIEM platforms, combining traditional rules with agentic AI workflows to accelerate threat detection development and validation.

The role emphasizes collaboration with Threat Intelligence, Threat Hunting, and SOC teams, with hands-on work writing detection logic, managing content as code, and improving alert fidelity