Senior Detection Engineer - Threat-Driven Automation

F5 Networks, Inc; Warsaw (IN); On-site; USD 120,000 - 180,000; Full time

Job summary

F5 Networks, Inc in Indiana is seeking a Security Engineer III, Detection Engineering to design, implement, and improve detection content across SIEM/EDR and cloud telemetry, partnering with Incident Response and Threat Intelligence to reduce risk.

You will translate threat intel into reliable detections, automate workflows, validate with adversary emulation, and contribute to on-call coverage in a growing Security Operations framework.

Qualifications

• Bachelor's degree or equivalent practical experience in information security, CS, or engineering.
• 5+ years in cybersecurity, security engineering, detection engineering, or related fields.
• Experience developing or tuning detections in SIEM/EDR or security monitoring platforms.
• Scripting and data analysis with Python, PowerShell, SQL, or similar tools.
• Strong knowledge of attacker techniques and MITRE ATT&CK framework.
• Strong analytical, communication, and collaboration skills.

Responsibilities

• Develop and maintain detections with Detection-as-Code practices and CI/CD.
• Map telemetry to adversary behaviors and MITRE ATT&CK to improve coverage.
• Collaborate with Incident Response, Threat Intelligence, and Logging Engineering teams.
• Tune detections via adversary emulation and production feedback to reduce false positives.
• Automate detection workflows, alert enrichment, and on-call activities.
• Onboard new log sources and ensure coverage across environments.

Skills

Detection engineering

Python scripting

MITRE ATT&CK

SIEM/EDR experience

Analytical thinking

Cross-functional collaboration

Education

Bachelor's degree in Information Security, Computer Science, Engineering

Tools

CrowdStrike

Splunk

Microsoft Sentinel

Chronicle

Elastic

Job description

F5 Networks, Inc in Indiana is seeking a Security Engineer III, Detection Engineering to design, implement, and improve detection content across SIEM/EDR and cloud telemetry, partnering with Incident Response and Threat Intelligence to reduce risk.

You will translate threat intel into reliable detections, automate workflows, validate with adversary emulation, and contribute to on-call coverage in a growing Security Operations framework.