Senior Threat Detection Engineer - Remote

gh; United States; Hybrid; USD 134,000 - 184,000; Full time

Job summary

gh is seeking a seasoned security engineering leader to strengthen detection, investigation, and response across on-prem, cloud, and AI-enabled environments. You will drive detection engineering, threat intelligence, automation, and incident response while improving monitoring and risk practices enterprise-wide.

You will build detections across infrastructure, cloud, and identity platforms; lead investigations with external MSS providers; and create dashboards to track posture and performance.

Qualifications

• Eight+ years in security engineering, security operations, detection engineering, or incident response.
• Hands-on experience creating, testing, and tuning SIEM and endpoint detection rules.
• Experience leading technical investigations and coordinating containment, eradication, and recovery.
• Knowledge of AWS investigations, cloud telemetry, and identity/access logs.
• Strong written and verbal communication; understanding of AI/ML security, automation, and governance.

Responsibilities

• Build and maintain threat detections across infrastructure, endpoints, cloud services, SaaS, and identity platforms; test and tune them to improve coverage and reduce false alerts.
• Work with a managed detection and response provider to improve detection rules, investigation quality, escalations, and response workflows.
• Participate in incident response, including investigation, containment, eradication, recovery, and post-incident review.
• Monitor cloud environments and relevant telemetry, including AWS activity, network flow, workload, and SaaS integration logs.
• Create dashboards and reports that track detection coverage, security operations performance, and overall posture.
• Document operational playbooks, assess AI-assisted security capabilities, and mentor engineers across security operations and engineering.

Skills

SIEM tuning

Endpoint detection

Incident response

Cloud security

Threat intelligence

Communication

Tools

MISP

Yeti

OpenCTI

Job description

gh is seeking a seasoned security engineering leader to strengthen detection, investigation, and response across on-prem, cloud, and AI-enabled environments. You will drive detection engineering, threat intelligence, automation, and incident response while improving monitoring and risk practices enterprise-wide.

You will build detections across infrastructure, cloud, and identity platforms; lead investigations with external MSS providers; and create dashboards to track posture and performance.