Senior Threat Intelligence & Detection Architect

Jobtailor; Seattle (WA); On-site; USD 110,000 - 160,000; Full time

Job summary

Jobtailor is seeking an experienced Threat Intelligence & Detection Engineer to design and maintain high-fidelity detection rules in CrowdStrike NG-SIEM. You will own the full detection lifecycle, map threat actor behaviors to telemetry sources, and collaborate across SOC, IAM, and platform teams.

Experience with AI-assisted tooling and cloud telemetry is a plus. The role requires 4+ years in related fields, strong writing, and hands-on EDR/THREAT hunting capabilities.

Qualifications

• Requires 4+ years in detection engineering, threat intel, SOC/IR, threat hunting, or security automation
• Proficient in detection logic writing on at least one enterprise SIEM/XDR; CrowdStrike NG-SIEM preferred
• Familiarity with MITRE ATT&CK technique/sub-technique levels
• Able to map adversary behaviors to telemetry sources and detection logic
• Hands-on with EDR analysis, behavioral anomaly detection, and post-exploitation investigation
• Experience with hypothesis-driven threat hunting and end-to-end hunt documentation
• Python/PowerShell scripting for automation and tooling
• Experience in incident response for malware, identity-based, or insider threats
• Strong written communication with clear detection rationale and intel products
• Experience with cloud telemetry (Azure/AWS) and cloud-native detection
• GIAC GCIA/GCIH/GCTI/GDAT or equivalent preferred

Responsibilities

• Design, develop, and maintain detection logic across SIEM/XDR platforms
• Operationalize the full detection lifecycle from threat modeling to deployment
• Align detections to MITRE ATT&CK and threat model priorities
• Translate intelligence findings into durable detection logic
• Collaborate with CSIRT, SOC, IAM, and platform teams
• Develop automation for deployment, triage, and enrichment
• Lead threat hunts and document outcomes for library feedback
• Mentor junior team members and contribute to purple team exercises
• Provide technical escalation during complex incidents
• Develop runbooks and analyst guidance
• Integrate detection with CI/CD and threat intel feeds

Skills

Detection Engineering

Threat Intelligence

Threat Hunting

Python Scripting

PowerShell

MITRE ATT&CK Knowledge

Incident Response

Documentation

Education

Bachelor's degree in Computer Science/Information Security

Equivalent professional experience

Tools

CrowdStrike NG-SIEM (LogScale/CQL)

SIEM/EDR/SOAR

Git & CI/CD

Threat Intelligence Platforms

Job description

Jobtailor is seeking an experienced Threat Intelligence & Detection Engineer to design and maintain high-fidelity detection rules in CrowdStrike NG-SIEM. You will own the full detection lifecycle, map threat actor behaviors to telemetry sources, and collaborate across SOC, IAM, and platform teams.

Experience with AI-assisted tooling and cloud telemetry is a plus. The role requires 4+ years in related fields, strong writing, and hands-on EDR/THREAT hunting capabilities.