Senior Threat Detection & Automation Engineer

Northwestern Mutual Investment Services, LLC; Milwaukee (WI); Hybrid; USD 108,000 - 162,000; Full time

Job summary

Northwestern Mutual is seeking a Detection & Automation Engineer III to design, implement, and optimize threat detections across cloud, identity, endpoint, and application environments. You will work with cybersecurity, infrastructure, cloud, and application teams to mature our detection program and automation capabilities.

Responsibilities include building and maintaining detections in Splunk ES, improving telemetry quality, and leading Detection‑as‑Code initiatives within CI/CD pipelines.

Qualifications

• Bachelor's degree in Cybersecurity, IT, CS, Engineering, or related field.
• 2+ years of cybersecurity, detection engineering, security operations, SIEM engineering, or related disciplines.
• Hands-on experience developing and maintaining threat detections within Splunk Enterprise Security or comparable SIEM platforms.
• Strong understanding of security monitoring, log management, telemetry engineering, and threat detection methodologies.
• Experience with cloud platforms, identity systems, endpoint security technologies, applications, databases, and enterprise infrastructure.

Responsibilities

• Design, develop, test, and maintain advanced threat detections across security platforms and data sources.
• Enhance detection coverage by identifying telemetry gaps and improving visibility.
• Administer and optimize Splunk Enterprise Security, including ES frameworks, data models, dashboards, and search performance.
• Troubleshoot and resolve security data ingestion, field extraction, parsing, normalization, and performance issues.
• Partner with technology teams to onboard new security data sources and validate telemetry quality.
• Develop and maintain security logging standards, monitoring controls, and data quality processes.
• Design monitoring capabilities for enterprise databases and business‑critical applications, focusing on privileged access and anomalous activity.

Skills

Threat detection

SIEM engineering

Cloud security

Scripting (Python/PowerShell)

CI/CD pipelines

Troubleshooting

Cross-functional collaboration

Security monitoring

Education

Bachelor's degree in Cybersecurity, IT, CS, Engineering, or related field

Tools

Splunk Enterprise Security

Cribl Stream

CI/CD tooling

PowerShell

Python

SQL/Databases

Job description

Northwestern Mutual is seeking a Detection & Automation Engineer III to design, implement, and optimize threat detections across cloud, identity, endpoint, and application environments. You will work with cybersecurity, infrastructure, cloud, and application teams to mature our detection program and automation capabilities.

Responsibilities include building and maintaining detections in Splunk ES, improving telemetry quality, and leading Detection‑as‑Code initiatives within CI/CD pipelines.