Threat Detection Architect: Cloud & GovCloud Security

Darkwolfsolutions; Ogden (UT); On-site; USD 100,000 - 160,000; Full time

Job summary

Dark Wolf is seeking a Threat Detection Engineer to design, build, test, and deploy detection logic using a Detection-as-Code approach across on-prem and AWS GovCloud environments. You will create high-fidelity alerts, hunt threats, and automate response workflows to reduce alert fatigue while leveraging AI/ML to accelerate detection development.

This full-time, on-site role is based at Hill AFB in Ogden, Utah, and requires US citizenship with a Top Secret/SCI clearance.

Qualifications

• 4+ years of relevant experience.
• 2+ years authoring/tuning detection logic in Splunk Enterprise and ELK Stack.
• Experience with DoD cybersecurity requirements, policies, and procedures.
• Experience in vSOC/SOC/CSSP environments.
• US Citizenship and Top Secret/SCI clearance required.

Responsibilities

• Design, build, test, and deploy detection logic across on-prem and AWS GovCloud.
• Write and maintain custom detection signatures for cloud-native vectors, containers, and host behavior.
• Ingest and analyze AWS security logs and on-prem telemetry into SIEM/data lake.
• Hunt for threats and map MITRE ATT&CK Cloud techniques.
• Develop automated remediation/playbooks with GitLab pipelines.
• Improve alert fidelity by root cause analysis of false positives/negatives.

Skills

Splunk

ELK Stack

GitLab

Terraform

CloudFormation

Education

Bachelor's degree in Computer Science/IT

Job description

Dark Wolf is seeking a Threat Detection Engineer to design, build, test, and deploy detection logic using a Detection-as-Code approach across on-prem and AWS GovCloud environments. You will create high-fidelity alerts, hunt threats, and automate response workflows to reduce alert fatigue while leveraging AI/ML to accelerate detection development.

This full-time, on-site role is based at Hill AFB in Ogden, Utah, and requires US citizenship with a Top Secret/SCI clearance.