Threat Detection Engineer, Cloud & GovCloud Security

Dark Wolf Solutions, LLC; Town of Ogden (NY); On-site; USD 110,000 - 150,000; Full time

Job summary

Dark Wolf Solutions, LLC is seeking a Threat Detection Engineer to design, build, test, and deploy detection logic using Detection-as-Code across on-prem and AWS GovCloud. This role emphasizes high-fidelity alerts, threat hunting against sophisticated adversaries, and automating response workflows to reduce alert fatigue.

The engineer will leverage AI/ML to accelerate detection development, optimize queries, and streamline incident response while working fully on-site at Hill AFB in Ogden, Utah.

Qualifications

• 4+ years of relevant experience in threat detection engineering.
• 2+ years tuning detection logic in Splunk Enterprise and the ELK Stack.
• 2+ years with DoD cybersecurity requirements, policies, and A&A activities.
• Experience within a vSOC, SOC, or CSSP responding to cyber incidents.
• Experience ingesting and engineering detections for AWS GovCloud telemetry.
• Experience using GitLab for Detection-as-Code and DevSecOps workflows.
• DoDD 8140 IAT CSSP Certification must be obtained prior to hire.
• US Citizenship and an active Top Secret/SCI clearance.
• Bachelor’s degree in Computer Science, Information Technology, or a related field.

Responsibilities

• Design, build, test, and deploy detection logic using Detection-as-Code across on-prem and AWS GovCloud environments.
• Write and maintain custom detection signatures for cloud-native vectors, containers, and host behavior.
• Ingest, normalize, and analyze AWS security logs and on-prem telemetry into SIEM and data lake environments.
• Proactively hunt for undetected malicious activity and map to MITRE ATT&CK Cloud Matrix.
• Partner with NOSC operators and AWS Engineers to automate remediation and incident response playbooks in GitLab pipelines.
• Conduct root-cause analysis on false positives/negatives to improve alert fidelity.
• Utilize AI-assisted analysis and ML features to enhance query generation and threat intelligence correlation.
• Contribute to DCO concepts, processes, and procedures.
• Support vulnerability management mitigations and adhere to BSTG policies.
• Develop DCO TTPs, threat models, and supporting technical documentation.

Skills

Threat detection

Splunk ELK

GitLab CI/CD

Detection-as-Code

Threat hunting

AI/ML for detection

Incident response

MITRE ATT&CK Cloud

Security clearance

Education

Bachelor's degree in CS/IT or related

Tools

Terraform

CloudFormation

Falco

eBPF

Docker security

Kubernetes

RHEL

Job description

Dark Wolf Solutions, LLC is seeking a Threat Detection Engineer to design, build, test, and deploy detection logic using Detection-as-Code across on-prem and AWS GovCloud. This role emphasizes high-fidelity alerts, threat hunting against sophisticated adversaries, and automating response workflows to reduce alert fatigue.

The engineer will leverage AI/ML to accelerate detection development, optimize queries, and streamline incident response while working fully on-site at Hill AFB in Ogden, Utah.