Senior Detection Engineer — AI‑Driven SOC, Hybrid

Gravity IT Resources; Mountain View (CA); Hybrid; USD 96,000 - 138,000; Full time

Job summary

Gravity IT Resources seeks an Information Technology Security Engineer to support detection and platform engineering within threat operations. Hybrid work with onsite presence is required, and the team focuses on building pipelines, automating tasks, and enhancing incident response across EDR, cloud, and network telemetry.

The role emphasizes development of Detection-as-Code, SOAR playbooks, and alignment with MITRE ATT&CK and zero-trust concepts.

Qualifications

• Proven SOC experience in detection engineering, security engineering, or senior analyst roles with an engineering mindset.

Responsibilities

• Administer and enhance the Security Incident Response module: workflows, rules, SLA definitions, UI configuration, and integrations.
• Design, build, and maintain the Detection-as-Code pipeline: detection development, version control, CI/CD testing, and deployment automation.
• Develop and tune detections across EDR, cloud, network, email, and DLP telemetry.
• Build SOAR playbooks, API integrations, and automation workflows.
• Support SIEM/SOAR platform administration and optimization.
• Contribute to AI SOC initiatives: investigation expansion, alert triage automation, and platform health.
• Apply MITRE ATT&CK, FP-rate gating, and detection lifecycle standards to deployed content.
• Partner with SOC analysts to translate operational gaps into engineering solutions.

Skills

SOC detection

Python scripting

MITRE ATT&CK

Detection pipelines

ServiceNow SIR

CI/CD

EDR & Cloud security

Zero Trust

DLP concepts

AI/LLM security

Tools

SIEM

SOAR

CI/CD tooling

Job description

Gravity IT Resources seeks an Information Technology Security Engineer to support detection and platform engineering within threat operations. Hybrid work with onsite presence is required, and the team focuses on building pipelines, automating tasks, and enhancing incident response across EDR, cloud, and network telemetry.

The role emphasizes development of Detection-as-Code, SOAR playbooks, and alignment with MITRE ATT&CK and zero-trust concepts.