Sr. Detection Engineer

Cboe Global Markets, Inc.; Chicago (IL); Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Competitive compensation

Generous paid time off

Hybrid work environment

Health, dental, vision benefits

401(k) match

Tuition assistance

Parental leave

Referral program

Job summary

Cboe Global Markets, Inc. is seeking a Senior Detection Engineer to design and validate production detections across SIEM, EDR, cloud, and identity systems.

You will develop tooling for adversary simulations and repeatable validation, while advancing automation and AI-assisted workflows to shorten detection cycles. The role requires strong scripting skills, deep telemetry knowledge, and experience with Windows/AD, cloud platforms, and security testing.

Qualifications

• 5+ years of hands-on security engineering experience with substantial detection authoring content
• Strong command of at least one detection query language (KQL, Sigma, YARA-L, or equivalent)
• Practical knowledge of attacker techniques across Windows and cloud platforms at execution mechanics level
• Ability to read unfamiliar exploit or malware code and identify detectable artifacts
• Fluency in at least one tooling language (Python, Go, C#, PowerShell, bash)
• Working knowledge of telemetry: Windows event logs, EDR, cloud audit logs, identity sign-in data
• Comfort building test infrastructure using virtualization, containers, IaC, and CI/CD
• Disciplined approach to false positives and alert quality
• Clear technical writing for engineers and response guidance
• High ethical standards around authorization, scope, blast radius, and sensitive data handling
• Bachelor’s degree or equivalent practical experience

Responsibilities

• Write, tune, and maintain production detection logic across SIEM, EDR, identity, and cloud platforms with high fidelity
• Validate every detection by executing the targeted technique before production
• Build internal tooling to simulate adversary behavior for repeatable detection testing
• Create reusable validation packages and automated regression tests after agent/platform/config changes
• Operate sandbox and detonation infrastructure for exploit triage and malware analysis
• Evaluate new exploit PoCs for telemetry and effectiveness, translating to detections
• Produce threat hunting validation content with seeded artifacts and known-truth datasets
• Automate repeatable work: scheduled technique execution, telemetry collection, coverage reporting
• Apply AI/LLM tooling to shorten cycle time in triage, analysis, and hunt hypothesis drafting
• Conduct security testing of internal web apps and APIs and translate findings into detections
• Support Incident Response with attacker tradecraft insights and develop detections from investigations
• Document and hand off work so others can operate tooling and environments independently

Skills

Detection engineering

SIEM

EDR

KQL

Sigma

YARA-L

Python

Go

PowerShell

Threat hunting

Technical writing

Cloud platforms

Education

Bachelor’s degree or equivalent practical experience

Tools

Splunk

Elastic SIEM

AWS CloudWatch

Azure Monitor

Job description

Job Description

At Cboe, we inspire our people to solve complex challenges together because what we do matters. We provide the financial infrastructure that powers the global economy. As a leading provider of market infrastructure and tradable products, Cboe delivers cutting-edge trading, clearing and investment solutions to market participants around the world.

Sound like the place for you? Join us! The Security Operations team is hiring a Senior Detection Engineer.

In this role you’ll be responsible for

• Writing, tuning, and maintaining production detection logic across SIEM, EDR, identity, and cloud platforms, with explicit attention to fidelity and false positive cost
• Validating every detection by executing the technique it targets, so that no rule reaches production unproven
• Building and maintaining internal tooling that simulates adversary behavior on demand, making detection testing repeatable rather than manual
• Building reusable validation packages and automated regression testing so coverage is re-verified continuously and after every agent, platform, or configuration change
• Building and operating sandbox and detonation infrastructure, including disposable, instrumented environments for exploit triage, malware analysis, and safe technique development
• Evaluating newly published proof-of-concept exploit code to determine whether it functions, what telemetry it generates, and whether Cboe is exposed, then converting the answer into detection or hunting content
• Producing threat hunting validation content, including seeded artifacts, known-truth datasets, and repeatable test cases that establish whether a hypothesis is testable with the data we hold
• Automating the repeatable work: scheduled technique execution, telemetry collection, coverage reporting, and detection performance measurement
• Applying AI and LLM tooling where it measurably shortens cycle time, including agentic workflows for triage and enrichment, automated analysis of exploit and malware code, detection and test-case drafting, and hunt hypothesis generation
• Conducting security testing of internally built web applications and APIs, and translating findings into detection requirements as well as remediation guidance
• Supporting Incident Response during complex investigations with concrete attacker tradecraft insight, and closing the loop by building detections for what the investigation surfaces
• Documenting and handing off work so that tooling, environments, and test content can be operated by others independently

The ideal candidate has

• 5+ years of hands-on security engineering experience with substantial detection authoring content, and the ability to speak concretely about detections you built, how you validated them, and how they performed in production
• Strong command of at least one detection query language (KQL, Sigma, YARA-L, or equivalent) and the judgment to recognize when logic is too brittle or too broad to ship
• Practical knowledge of attacker techniques across Windows and Active Directory, Entra ID, cloud platforms (AWS, Azure), SaaS, and containerized workloads, at the level of execution mechanics rather than technique names
• The ability to read unfamiliar exploit or malware code and identify the observable artifacts worth detecting on
• Real fluency in at least one language used to write tooling (Python, Go, C#, PowerShell, bash, or equivalent
• Working knowledge of the telemetry itself, including Windows event logs, EDR process and network events, cloud audit logs, and identity sign-in data, and where each is unreliable, incomplete, or trivially evaded
• Comfort building and tearing down test infrastructure using virtualization, containers, infrastructure-as-code, and CI/CD
• A disciplined approach to false positives, alert quality, and the operational burden that detections place on analysts
• Clear technical writing aimed at engineers, including detection documentation and analyst-facing response guidance
• High ethical standards and demonstrated discipline around authorization, scope, blast radius, and handling of sensitive data
• Bachelor’s degree or equivalent practical experience

You’ll really stand out with

• Public detection content, tooling, or research that we can review
• Hands-on experience with atomic testing frameworks or continuous control validation at scale
• Use of MITRE ATT&CK as a coverage and gap-analysis instrument rather than a reporting label
• Concrete AI engineering experience, such as agentic workflows, tool and MCP integration, or testing LLM-application abuse cases including prompt injection
• Reverse engineering, Windows internals, or EDR telemetry and evasion research
• Experience operating in regulated or large enterprise environments, especially financial services
• A track record of mentoring engineers or building internal training material
• Curiosity, adaptability, and a continuous improvement mindset

Benefits And Perks

• Fair and competitive salary and incentive compensation packages with an upside for overachievement
• Generous paid time off, including vacation, personal days, sick days and annual community service days
• Flexible, hybrid work environment
• Health, dental and vision benefits, including access to telemedicine and mental health services
• 2:1 401(k) match, up to 8% match immediately upon hire
• Discounted Employee Stock Purchase Plan
• Tax Savings Accounts for health, dependent and transportation
• Employee referral bonus program
• Volunteer opportunities to help you give back to your communities

Some of our associates' favorite benefits and perks include:

• Complimentary lunch, snacks and coffee in any Cboe office
• Paid Tuition assistance and education opportunities
• Generous charitable giving company match
• Paid parental leave and fertility benefits
• On-site gyms and discounts to other fitness centers

More About Cboe

We're