Senior Detection Engineer (Next-Gen Threat Hunter)

Intrado Life & Safety, Inc.; Longmont (CO); On-site; USD 140,000 - 175,000; Full time

Benefits offered by this job

Medical, dental, vision

Paid time off

401(k) retirement plan

Paid parental leave

Employee discounts

Job summary

Intrado Life & Safety, Inc. is seeking a Senior Detection Engineer to build high-fidelity detection pipelines across multi-cloud and on‑prem environments. You will design automated detections, develop behavioral models, and secure cloud control planes while aligning with MITRE ATT&CK and identity-centric strategies.

The role emphasizes threat hunting, SOAR automation, and mentoring SOC/IR teams. The starting salary ranges from $140,000 to $175,000, with a comprehensive rewards package and

Qualifications

• 5+ years of progressive cybersecurity experience including detection engineering, security operations, incident response or threat hunting.
• Experience securing AWS and Azure control planes, IAM, storage access and cloud log management.
• Minimum 3+ years writing clean automations and scripts to manipulate APIs/data structures (Python, Go, Bash, PowerShell).
• Proven track record in hunting based on identity and behavior rather than static signatures.
• Hands-on experience with Cortex XSIAM, SIEM/XDR/XSIAM orchestration and automation workflows.

Responsibilities

• Design high-fidelity detection pipelines that identify automated attack chains within minutes or seconds.
• Build behavioral models focusing on identity and anomaly detection.
• Secure cloud control planes across AWS and Azure and monitor API activity and configuration drift.
• Unify threat visibility across external, insider and non-human threats through identity-centric controls.
• Develop production-grade security code and automation workflows to operationalize threat-hunting hypotheses.
• Map detection logic to MITRE ATT&CK and cloud/container/identity techniques.
• Deploy tripwires, honey-tokens, and other deception assets to detect post-compromise activity.
• Analyze API telemetry from applications, Kubernetes, and cloud services to detect abuse and takeovers.
• Mentor SOC/IR teams and refine SIEM/XDR/XSIAM playbooks for faster containment.
• Continuously harden detection logic and optimize data ingestion pipelines.

Skills

Cybersecurity experience

Detection engineering

Security operations

Automation coding

Multi-cloud security

Container security (Kubernetes)

Threat hunting

SOAR automation

Tools

AWS

Azure

Kubernetes

S3/Azure storage

MITRE ATT&CK

Cortex XSIAM

XSOAR

Job description

About Us

Intrado is dedicated to saving lives and protecting communities, helping them prepare for, respond to, and recover from critical events. Our cutting-edge companystrives to become the most trusted, data-centric emergency services partner by uniting fragmented communications into actionable intelligence for first responders. At Intrado, all of our work truly matters.

Responsibilities/Qualifications

Senior Detection Engineer (Next-Gen Threat Hunter)

The modern threat actor moves in seconds or minutes, not days. We are shifting to a detections capability focused on where our data is located (SaaS platforms, automation pipelines, user-controlled data storage) and the knowledge that the future of our perimeter is identity based. As a Detection Engineer, you will not just operate security tools—you will design a high-fidelity system that makes our multi-cloud and on-prem environment inherently hostile to adversaries. This position will be its own customer, building and operating detections, growing from feedback in the field, and iterating. This position will spend (for rough example) 70% on engineering detections for automated attack chains and performing response and triage, with 15% on more traditional log reviews or IOCs, and 15% on strategy and modeling the adversary.

Key Responsibilities:

• Design Automated Logic:Design and implement high-fidelity detection pipelines that detect automated attack chains within minutes or seconds.

• Build Behavioral Models: Shift focus from static indicators (like file hashes) to complex behavioral analytics and anomaly detection.

• Secure Cloud Control Planes: Monitor and protect AWS and Azure infrastructure by tracking API calls, configuration drift, and identity-based movements.

• Unify Threat Visibility: Dissolve boundaries between external attackers, non-human ID and insider threats by mastering the identity perimeter and focusing on potential credential activities.

• Develop Security Code: Write production-grade Python and automated workflows in other scripting and automation languages/tools to turn manual threat-hunting hypotheses into instantiated detections code.

• Map to Matrix Frameworks: Align detection logic with modern matrices like MITRE ATT&CK, focusing heavily on cloud, container, and identity techniques.

• Construct Tripwires: Deploy deceptive assets, honey-tokens, and behavioral tripwires to detect adversary lateral movement or actions post-compromise.

• Analyze API Telemetry: Deep-dive into application, Kubernetes, and cloud-service APIs to detect malicious API-shimming, data staging, and account takeovers.

• Collaborate and Mentor SOC and IR:Lead analytics and incident response as SME to ensure clean response and containment, ingest post-mortem data and continuously harden detection logic against new variants. Mentor analyst and engineering staff in areas of expertise.

• Optimize SIEM/XDR/XSIAM and Protections Pipelines: Refine data ingestion pipelines and engineer XSOAR playbooks to automatically triage and contain alerts with minimal analyst intervention.

• Design for the Future/Work in the Present: Our protections/controls matrix are top notch. You will ensure that our stack stays positioned for the always-evolving future, but that we optimize our tools and capabilities as they exist today, getting the most for the dollars invested while planning for what's next.

Candidate Prerequisites:

• Cybersecurity Experience:5+ years of progressive experience in cybersecurity, including experience in detection engineering, security operations, incident response, threat hunting, security engineering, or a related discipline.

• Security Operations Expert:You have a background in technical/network security, systems and/or network engineering or cloud computing, and have done traditional SOC analyst work whether single-hatted or as a generalist role.

• Operational Production Coding: Minimum 3+ years of experience writing clean automations and scripts in Python, Go, BASH, Helm, or PowerShell to manipulate APIs and data structures.

• Multi-Cloud Architecture Expertise: Proven experience securing AWS and Azure control planes, specifically auditing IAM, storage access (e.g., S3, Azure Blobs), and cloud log management.

• Container & Orchestration Security: Strong engineering experience with Kubernetes, including securing cluster control planes, monitoring Kube-audit logs, and analyzing container runtime telemetry.

• Behavioral Threat Hunting: Demonstrated track record of hunting based on identity, behavioral baselines, and Living-off-the-Land (LotL) techniques rather than static signatures.

• SOAR Automation Expert: Hands-on experience engineering automation playbooks, integrations, and orchestration flows specifically within Cortex XSIAM.

Physical Requirements:

• Position requires long periods of sitting, typing, and participating in phone or video calls.

On-call Requirements:

• Participation in a scheduled on-call rotation is a required responsibility of this position. On-call assignments typically occur once every four to five weeks and involve responding to security incidents, critical alerts, and potential threats that require investigation, triage, or containment outside of normal business hours.

Total Rewards

Want to love where you work? At Intrado, we offer a comprehensive benefits package that includes what you’d expect (medical, dental, vision, life and disability coverage, paid time off, a 401(k) retirement plan, and several that go above and beyond– paid parental leave, access to a robust library of personal and professional training resources, employee discounts, critical illness, hospital indemnity, access to legal support, pet insurance, identity theft protection,an EAP (Employee Assistance Program) that includes free mental health resources/support, and more!

The starting salary is anticipated between $140,000 and $175,000 and will be commensurate with experience.

Intrado is an Equal Opportunity Employer – Veterans/Disabled and Other Protected Categories. Our Company welcomes and encourages applications of individuals with disabilities. Accommodations are available on request for candidates taking part in all aspects of the selection process. Intrado maintains a Drug Free Workplace.