Senior Threat Detection Engineer (Anvilogic, Splunk)

Truist; Raleigh (NC); On-site; USD 150,000 - 190,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401k plan

Paid time off

Sick days

Job summary

Truist seeks a Senior Threat Detection Engineer to design, implement, and optimize detections across Splunk, Snowflake, and related platforms. You will drive detection engineering, content development, and Snowflake engineering while collaborating with SOC and IR teams to improve coverage and reduce false positives.

Candidates should have hands-on Anvilogic expertise and experience in regulated industries. Key focus areas include detection-as-code, multi-platform orchestration, and telemetry

Qualifications

• Bachelor's degree or equivalent in a related field or equivalent work experience.
• 7+ years in security engineering or related cybersecurity roles.
• Deep knowledge of cybersecurity principles and secure SDLC practices.
• Experience with threat modeling, security testing, and penetration testing.
• Experience implementing and managing complex information security technologies.
• Proven ability to align detections to MITRE ATT&CK and regulatory requirements.

Responsibilities

• Design, develop, and maintain high-fidelity detections across Splunk, Snowflake, and related platforms.
• Author SPL-based detections and SQL-based queries for detection development.
• Snowflake engineering: design queries, manage Snowpipe pipelines for real-time and batch ingestion.
• Develop and maintain Cribl/Databahn integrations for routing, enrichment, and observability.
• Provide platform administration for Splunk and Snowflake environments.
• Align detections with MITRE ATT&CK and regulatory controls (PCI-DSS, HIPAA, SOX, GLBA).
• Apply Anvilogic-driven detection engineering: detection-as-code, coverage analytics, lifecycle management.
• Collaborate with SOC, IR, Threat Intel, and Data Engineering teams to reduce false positives.

Skills

Anvilogic

Splunk SPL

Snowflake/Snowpipe

SQL (MySQL / PostgreSQL / SQL Server)

Cribl/Databahn

Python

Docker/Kubernetes

Threat modeling

MITRE ATT&CK

Security engineering

Education

Bachelor's degree or equivalent

Tools

Snowflake

Snowpipe

Cribl/Databahn

Anvilogic

Splunk

SQL tooling

Docker / Kubernetes

Job description

Truist seeks a Senior Threat Detection Engineer to design, implement, and optimize detections across Splunk, Snowflake, and related platforms. You will drive detection engineering, content development, and Snowflake engineering while collaborating with SOC and IR teams to improve coverage and reduce false positives.

Candidates should have hands-on Anvilogic expertise and experience in regulated industries. Key focus areas include detection-as-code, multi-platform orchestration, and telemetry