Senior Detection Engineering Lead - AI-Driven Security

Cisco; Knoxville (TN); Hybrid; USD 151,000 - 191,000; Full time

Job summary

Cisco is seeking a Security Engineer within the Detection Engineering team to secure our portfolio and partner with Threat Hunting, SOC, and IR teams. You will design scalable detection content, implement AI/ML-powered signals, and contribute to cross-functional security initiatives on a hybrid on-site/remote basis in the U.S.

Responsibilities include deploying and maintaining security content, building SPL queries at scale, integrating threat intel with coverage metrics, and mentoring teammates

Qualifications

• Bachelor’s degree plus 8 years of related experience or Master’s with 6+ years or PhD with 3+ years.
• Deployed and maintained Splunk Enterprise Security content in a production SOC environment.
• Built detection queries in SPL at scale with risk-based alerting and optimized searches.
• Integrated AI/ML techniques into detection pipelines to reduce false positives and accelerate content development.
• Translated threat intel and ATT&CK mappings into detection coverage metrics and criteria.

Responsibilities

• Design scalable detection content and data pipelines for high-volume telemetry.
• Collaborate with SOC, IR, threat intel, and product teams on multi-functional detection initiatives.
• Mentor teammates on detection standards and design patterns and perform code reviews.

Skills

Splunk ES content

SPL queries

AI/ML techniques

Threat intel mapping

Detection content development

Code reviews

Mentoring

Python development

Data processing pipelines

Threat hunting collaboration

Education

Bachelor’s degree

Master’s degree

PhD

Tools

GitHub

GitLab

Bitbucket

AWS

GCP

Azure

CloudTrail

Azure Monitor

Job description

Cisco is seeking a Security Engineer within the Detection Engineering team to secure our portfolio and partner with Threat Hunting, SOC, and IR teams. You will design scalable detection content, implement AI/ML-powered signals, and contribute to cross-functional security initiatives on a hybrid on-site/remote basis in the U.S.

Responsibilities include deploying and maintaining security content, building SPL queries at scale, integrating threat intel with coverage metrics, and mentoring teammates