Senior Threat Detection Engineer: Anvilogic & Splunk

Truist; Atlanta (GA); On-site; USD 145,000 - 195,000; Full time

Job summary

Truist in Atlanta, GA seeks a Senior Threat Detection Engineer to design, develop, and optimize enterprise-grade detection capabilities across security platforms. You will work hands-on with Anvilogic, including detection-as-code and cross-platform orchestration, to ensure robust coverage analytics.

The role requires expertise with Splunk and Snowflake, plus Snowpipe ingestion and familiarity with Cribl/Databahn for scalable telemetry routing and enrichment. English fluency is required.

Qualifications

• Bachelor’s degree or equivalent education, training, and work-related experience.
• Minimum of 7 years of experience in security engineering or related cybersecurity roles.
• Deep specialized knowledge in cybersecurity principles, theories, and concepts.
• Proven experience in software development lifecycle security practices.
• Deep knowledge of threat modeling, security testing, and penetration testing.
• Experience implementing and managing complex information security technologies.

Responsibilities

• Design, develop, and maintain high-fidelity detections across Splunk, Snowflake, and related platforms.
• Author SPL-based detections (Splunk) and SQL-based queries (Snowflake, MySQL, PostgreSQL, SQL Server).
• Design and optimize queries within Snowflake for detection logic and threat hunting.
• Configure and maintain Snowpipe pipelines for real-time and batch ingestion of security-relevant data.
• Partner with data engineering to ensure schema design and ingestion pipelines support scalable detection use cases.
• Design and maintain integrations with Cribl/Databahn for log routing, transformation, and observability pipeline efficiency, telemetry enrichment, normalization, and cost‑optimized data movement.
• Map detections to the MITRE ATT&CK framework to ensure comprehensive threat coverage.
• Use detection‑as‑code workflows for structured creation, testing, and deployment of detections with Anvilogic.
• Collaborate with SOC and IR teams to streamline workflows and reduce false positives using Anvilogic‑driven integration.

Skills

Splunk SPL

Threat detection engineering

Snowflake

SQL

Anvilogic

Cribl/Databahn

MITRE ATT&CK

Python

Docker

Kubernetes

Security tooling

Regulated industries

Education

Bachelor’s degree or equivalent

Tools

Splunk

Snowflake

Snowpipe

Anvilogic

Cribl

Databahn

SQL databases (MySQL/PostgreSQL/SQL Server)

Job description

Truist in Atlanta, GA seeks a Senior Threat Detection Engineer to design, develop, and optimize enterprise-grade detection capabilities across security platforms. You will work hands-on with Anvilogic, including detection-as-code and cross-platform orchestration, to ensure robust coverage analytics.

The role requires expertise with Splunk and Snowflake, plus Snowpipe ingestion and familiarity with Cribl/Databahn for scalable telemetry routing and enrichment. English fluency is required.