Senior Threat Detection Engineer: Anvilogic + Splunk Expert

Truist; Charlotte (NC); On-site; USD 125,000 - 190,000; Full time

Benefits offered by this job

Medical benefits

401k plan

Vacation days

Job summary

Truist is seeking a Senior Threat Detection Engineer to design, develop, and optimize enterprise-grade detection capabilities across security platforms. The role requires hands-on expertise with Anvilogic, Splunk, Snowflake, and related data pipelines, with a focus on detection-as-code and coverage analytics.

You will collaborate with SOC/IR teams to align detections with MITRE ATT&CK, ensure regulatory compliance (PCI-DSS, HIPAA, SOX), and advance scalable telemetry routing and enrichment

Qualifications

• Bachelor's degree or equivalent education, training, and work-related experience.
• 7+ years of experience in security engineering or related cybersecurity roles.
• Deep specialized knowledge in cybersecurity principles, theories, and concepts.
• Experience in software development lifecycle security practices.

Responsibilities

• Design, develop, and maintain high-fidelity detections across Splunk, Snowflake, and related platforms.
• Author SPL-based detections (Splunk) and SQL-based queries (Snowflake, MySQL, PostgreSQL, SQL Server).
• Design and optimize Snowflake queries for detection logic and threat hunting.
• Configure and maintain Snowpipe pipelines for real-time and batch ingestion of security data.
• Partner with data engineering to ensure scalable detection use cases.
• Design and maintain integrations with Cribl/Databahn or similar for log routing and observability.

Skills

Threat modeling

Splunk SPL

SQL querying

Detection-as-code

Python

Security engineering

CI/CD security

Education

Bachelor's degree

Tools

Snowflake

Snowpipe

Splunk

Anvilogic

Cribl/Databahn

Job description

Truist is seeking a Senior Threat Detection Engineer to design, develop, and optimize enterprise-grade detection capabilities across security platforms. The role requires hands-on expertise with Anvilogic, Splunk, Snowflake, and related data pipelines, with a focus on detection-as-code and coverage analytics.

You will collaborate with SOC/IR teams to align detections with MITRE ATT&CK, ensure regulatory compliance (PCI-DSS, HIPAA, SOX), and advance scalable telemetry routing and enrichment