Senior Detection Engineer (Next-Gen Threat Hunter)

Socket.dev; Longmont (CO); On-site; USD 140,000 - 175,000; Full time

Job summary

Intrado is seeking a Senior Detection Engineer to build a high-fidelity threat-detection system across multi-cloud and on-prem environments. You will design detections, model adversaries, and mentor SOC/IR teams while enhancing threat visibility and automated response capabilities.

The role emphasizes identity-based perimeter protection, automated workflows, and continuous improvement of detection logic within a modern security stack. Competitive salary and comprehensive benefits offered.

Qualifications

• 5+ years of progressive experience in cybersecurity, including detection engineering, security operations, incident response, threat hunting, security engineering, or related discipline.
• Background in technical/network security, systems and/or cloud computing, with SOC analyst work experience.

Responsibilities

• Design high-fidelity detection pipelines for automated attack chains and rapid response.
• Develop behavioral analytics and anomaly detection beyond static indicators.
• Secure cloud control planes across AWS and Azure, monitor IAM and storage access.
• Unify threat visibility by focusing on identity perimeter and credential activity.
• Write production-grade Python and automation scripts to implement detections.
• Align detection logic to MITRE ATT&CK with cloud, container, and identity techniques.
• Deploy deceptive assets and honey tokens to detect lateral movement post-compromise.
• Analyze Kubernetes, application, and cloud-service APIs to detect malicious activity.
• Lead analytics and incident response as SME with SOC/IR teams and mentor staff.
• Refine SIEM/XDR/XSIAM pipelines and automate alert triage.

Job description

About Us

Intrado is dedicated to saving lives and protecting communities, helping them prepare for, respond to, and recover from critical events. Our cutting-edge companystrives to become the most trusted, data-centric emergency services partner by uniting fragmented communications into actionable intelligence for first responders. At Intrado, all of our work truly matters.

Responsibilities/Qualifications

Senior Detection Engineer (Next-Gen Threat Hunter)

The modern threat actor moves in seconds or minutes, not days. We are shifting to a detections capability focused on where our data is located (SaaS platforms, automation pipelines, user-controlled data storage) and the knowledge that the future of our perimeter is identity based. As a Detection Engineer, you will not just operate security tools—you will design a high-fidelity system that makes our multi-cloud and on-prem environment inherently hostile to adversaries. This position will be its own customer, building and operating detections, growing from feedback in the field, and iterating. This position will spend (for rough example) 70% on engineering detections for automated attack chains and performing response and triage, with 15% on more traditional log reviews or IOCs, and 15% on strategy and modeling the adversary.

Key Responsibilities

• Design Automated Logic:Design and implement high-fidelity detection pipelines that detect automated attack chains within minutes or seconds.

• Build Behavioral Models: Shift focus from static indicators (like file hashes) to complex behavioral analytics and anomaly detection.

• Secure Cloud Control Planes: Monitor and protect AWS and Azure infrastructure by tracking API calls, configuration drift, and identity-based movements.

• Unify Threat Visibility: Dissolve boundaries between external attackers, non-human ID and insider threats by mastering the identity perimeter and focusing on potential credential activities.

• Develop Security Code: Write production-grade Python and automated workflows in other scripting and automation languages/tools to turn manual threat-hunting hypotheses into instantiated detections code.

• Map to Matrix Frameworks: Align detection logic with modern matrices like MITRE ATT&CK, focusing heavily on cloud, container, and identity techniques.

• Construct Tripwires: Deploy deceptive assets, honey-tokens, and behavioral tripwires to detect adversary lateral movement or actions post-compromise.

• Analyze API Telemetry: Deep-dive into application, Kubernetes, and cloud-service APIs to detect malicious API-shimming, data staging, and account takeovers.

• Collaborate and Mentor SOC and IR:Lead analytics and incident response as SME to ensure clean response and containment, ingest post-mortem data and continuously harden detection logic against new variants. Mentor analyst and engineering staff in areas of expertise.

• Optimize SIEM/XDR/XSIAM and Protections Pipelines: Refine data ingestion pipelines and engineer XSOAR playbooks to automatically triage and contain alerts with minimal analyst intervention.

• Design for the Future/Work in the Present: Our protections/controls matrix are top notch. You will ensure that our stack stays positioned for the always-evolving future, but that we optimize our tools and capabilities as they exist today, getting the most for the dollars invested while planning for what's next.

Candidate Prerequisites

• Cybersecurity Experience: 5+ years of progressive experience in cybersecurity, including experience in detection engineering, security operations, incident response, threat hunting, security engineering, or a related discipline.

• Security Operations Expert: You have a background in technical/network security, systems and/or network engineering or cloud computing, and have done traditional SOC analyst work whether single-hatted or as a generalist role.

• Operational Production Coding: Minimum 3+ years of experience writing clean automations and scripts in Python, Go, BASH, Helm, or PowerShell to manipulate APIs and data structures.

• Multi-Cloud Architecture Expertise: Proven experience securing AWS and Azure control planes, specifically auditing IAM, storage access (e.g., S3, Azure Blobs), and cloud log management.

• Container & Orchestration Security: Strong engineering experience with Kubernetes, including securing cluster control planes, monitoring Kube-audit logs, and analyzing container runtime telemetry.

• Behavioral Threat Hunting: Demonstrated track record of hunting based on identity, behavioral baselines, and Living-off-the-Land (LotL) techniques rather than static signatures.

• SOAR Automation Expert: Hands-on experience engineering automation playbooks, integrations, and orchestration flows specifically within Cortex XSIAM.

Physical Requirements

• Position requires long periods of sitting, typing, and participating in phone or video calls.

On-call Requirements

• Participation in a scheduled on-call rotation is a required responsibility of this position. On-call assignments typically occur once every four to five weeks and involve responding to security incidents, critical alerts, and potential threats that require investigation, triage, or containment outside of normal business hours.

Total Rewards

Want to love where you work? At Intrado, we offer a comprehensive benefits package that includes what you’d expect (medical, dental, vision, life and disability coverage, paid time off, a 401(k) retirement plan, and several that go above and beyond– paid parental leave, access to a robust library of personal and professional training resources, employee discounts, critical illness, hospital indemnity, access to legal support, pet insurance, identity theft protection,an EAP (Employee Assistance Program) that includes free mental health resources/support, and more! work worth doing!

The starting salary is anticipated between $140,000 and $175,000 and will be commensurate with experience.

Intrado is an Equal Opportunity Employer – Veterans/Disabled and Other Protected Categories. Our Company welcomes and encourages applications of individuals with disabilities. Accommodations are available on request for candidates taking part in all aspects of the selection process. Intrado maintains a Drug Free Workplace.