Threat Detection & Automation Engineer III

Milwaukee Succeeds; Milwaukee (WI); Hybrid; USD 108,000 - 162,000; Full time

Benefits offered by this job

Flexible work schedules

Concierge service

Comprehensive benefits

Employee resource groups

Job summary

Northwestern Mutual is seeking a Detection & Automation Engineer III to advance threat detection across cloud, identity, endpoint, database, and application environments. You will blend DevOps, detection engineering, SIEM, telemetry, and data integration to bolster security visibility and threat response.

You will lead, mentor, and collaborate across cybersecurity, infrastructure, cloud, and application teams to onboard telemetry, reduce false positives, and drive continuous improvements in

Qualifications

• Bachelor’s degree or equivalent professional experience in a related field.
• 2+ years in cybersecurity, detection engineering, security operations, SIEM engineering, or related disciplines.
• Hands-on experience developing and maintaining threat detections within Splunk Enterprise Security or comparable SIEM.
• Experience with cloud platforms, identity systems, endpoint security technologies, applications, databases, and enterprise infrastructure.

Responsibilities

• Design, develop, test, and maintain advanced threat detections across a variety of security platforms and data sources.
• Enhance detection coverage by identifying telemetry gaps and partnering with stakeholders to improve visibility across the environment.
• Administer and optimize Splunk Enterprise Security, including ES frameworks, data models, reporting, dashboards, and search performance.
• Troubleshoot and resolve security data ingestion, field extraction, parsing, normalization, and performance issues.
• Partner with technology teams to onboard new security data sources and validate telemetry quality.
• Develop and maintain security logging standards, monitoring controls, and data quality processes.
• Design monitoring capabilities for enterprise databases and business-critical applications, focusing on privileged access, authentication activity, anomalous behavior, and sensitive data access.
• Contribute to Detection-as-Code initiatives through version control, automated testing, CI/CD pipelines, and reusable detection frameworks.
• Track and improve key metrics including detection coverage, alert fidelity, telemetry health, and operational effectiveness.
• Drive continuous improvement efforts that reduce false positives, improve detection accuracy, and streamline security operations.
• Provide technical leadership, mentor junior engineers, and contribute to architectural and engineering best practices.

Skills

Detection Engineering

Security Monitoring

Cloud Security

SIEM Engineering

Scripting & Automation

Analytical Thinking

Communication Skills

Education

Bachelor’s degree in Cybersecurity/IT/CS/Engineering

Tools

Splunk Enterprise Security

Cribl Stream

Job description

Northwestern Mutual is seeking a Detection & Automation Engineer III to advance threat detection across cloud, identity, endpoint, database, and application environments. You will blend DevOps, detection engineering, SIEM, telemetry, and data integration to bolster security visibility and threat response.

You will lead, mentor, and collaborate across cybersecurity, infrastructure, cloud, and application teams to onboard telemetry, reduce false positives, and drive continuous improvements in