Threat Detection Engineer — AI/ML-Driven, DoD GovCloud

BuddoBot Inc.; Ogden (UT); On-site; USD 100,000 - 160,000; Full time

Job summary

Dark Wolf seeks a Threat Detection Engineer to design, build, test, and deploy detection logic using a Detection-as-Code approach across on-prem and AWS GovCloud environments. The role emphasizes high-fidelity alerts, threat hunting against modern adversaries, and automated response workflows to reduce alert fatigue.

The position leverages AI/ML to accelerate detection engineering, optimize query generation, and streamline incident response, with on-site work at Hill AFB in Ogden, Utah.

Qualifications

• 4+ years of relevant experience.
• 2+ years authoring and tuning detection logic in Splunk Enterprise and the ELK Stack (Elasticsearch, Logstash, Kibana).
• 2+ years of experience with DoD cybersecurity requirements, policies, and procedures including assessment and authorization activities.
• Experience within a vSOC, SOC, or CSSP responding to cyber incidents.
• Direct experience ingesting, normalizing, and engineering detections for AWS GovCloud security telemetry.
• Demonstrated experience using GitLab for Detection-as-Code, CI/CD pipelines, version control, and DevSecOps workflows.
• DoD Directive 8140 IAT CSSP Certification must be obtained prior to hire (CEH, CCNA Security, GCIH, CySA+ or Equivalent).
• Bachelor's degree in Computer Science, Information Technology, or a related field.
• US Citizenship and an active Top Secret/SCI security clearance required.

Responsibilities

• Design, build, test, and deploy detection logic across on-prem and AWS GovCloud environments.
• Write and maintain custom detection signatures for cloud-native vectors, containers, and host-level behavior.
• Ingest and analyze AWS security logs and on-prem telemetry into SIEM and data lakes.
• Hunt for undetected malicious activity and adversary TTPs mapped to MITRE ATT&CK Cloud.
• Develop automated remediation and incident response playbooks in GitLab pipelines.
• Root-cause analysis on false positives/negatives to improve alert fidelity.
• Utilize AI-assisted analysis to enhance query generation and threat intelligence correlation.
• Contribute to DCO concepts of operations, processes, and procedures.
• Support vulnerability mitigations and adhere to BSTG policies and training.

Skills

GitLab

Detection-as-Code

AI/ML for detection

Threat hunting

SIEM

Education

Bachelor's degree in Computer Science, Information Technology, or a related field

Tools

Splunk Enterprise

ELK Stack

Terraform

CloudFormation

AWS GovCloud

Job description

Dark Wolf seeks a Threat Detection Engineer to design, build, test, and deploy detection logic using a Detection-as-Code approach across on-prem and AWS GovCloud environments. The role emphasizes high-fidelity alerts, threat hunting against modern adversaries, and automated response workflows to reduce alert fatigue.

The position leverages AI/ML to accelerate detection engineering, optimize query generation, and streamline incident response, with on-site work at Hill AFB in Ogden, Utah.