Senior Threat Engineer: AI-Driven Detection & Red Team

United States Digital Space LLC; United States; Remote; USD 137,000 - 191,000; Full time

Job summary

CDW is seeking a Senior Threat Engineer to design AI-powered detection and response capabilities that compress attacker dwell time from days to minutes. You will automate defensive actions and continuously red team defenses at attacker speed in production controls.

Responsibilities include building detections, emulation content, and autonomous response playbooks while reducing false positives and improving ATT&CK coverage.

Qualifications

• Bachelor’s degree and 7+ years in threat detection, hunting, incident response, or offensive security, or 11+ years of equivalent experience.
• Hands-on experience building and tuning detections in SIEM platforms and cloud-scale security tooling.
• Practical knowledge of MITRE ATT&CK mapping for detections and automated responses.

Responsibilities

• Engineer high‑fidelity detections across identity, endpoint, network, cloud, and SaaS with automated response paths.
• Apply AI/ML to triage and enrich alerts, surfacing attacker stories over fragments.
• Build autonomous response playbooks to isolate hosts, revoke sessions, and quarantine content within minutes.
• Implement guardrails: confidence thresholds, blast-radius controls, and safe rollback for actions.
• Instrument detections for measurable outcomes; drive improvements release over release.
• Lead continuous adversary emulation, emulating variants across ATT&CK in production.
• Document detection logic, emulation plans, and automation patterns for long-term maintainability.

Skills

Threat detection engineering

Threat hunting

Incident response

Offensive security

Python

AI/ML for security

SOAR platforms

Education

Bachelor’s degree

Tools

SIEM

Cloud security tooling

Job description

CDW is seeking a Senior Threat Engineer to design AI-powered detection and response capabilities that compress attacker dwell time from days to minutes. You will automate defensive actions and continuously red team defenses at attacker speed in production controls.

Responsibilities include building detections, emulation content, and autonomous response playbooks while reducing false positives and improving ATT&CK coverage.