Threat Detection Engineer – Cloud & On-Prem

NSD International, Inc; Charlotte (NC); On-site; USD 110,000 - 160,000; Full time

Job summary

NSD International, Inc. is seeking a Cyber Security Engineer specializing in Threat Detection to join a high-performing Security Operations team.

You will build, tune, and maintain detections across cloud and on-prem environments to proactively identify, investigate, and respond to threats, applying detection-as-code, automation, and analytics. Collaborate with analysts, incident responders, threat intel, and technology partners to translate threats into actionable detection strategies, develop

Qualifications

• 3+ years in cybersecurity, detection engineering, SOC engineering, security analytics, or security operations.
• Hands-on experience analyzing logs and telemetry from multiple sources (endpoint, network, identity, cloud, infrastructure, apps).
• Experience mapping detections to MITRE ATT&CK or similar frameworks and building detection-as-code pipelines.

Responsibilities

• Design, develop, tune, and maintain threat detection logic across cloud and on-premises environments.
• Build and maintain data ingestion and log onboarding pipelines for security telemetry.
• Collaborate with analysts, incident responders, threat intel, and technology partners to translate threats into detections.
• Develop and fine‑tune detection rules, signatures, correlation logic, and alert thresholds to improve fidelity and reduce false positives.
• Map detections to MITRE ATT&CK and ensure documentation and procedures are up to date.

Skills

Cybersecurity

Detection engineering

SOC engineering

Security analytics

Security operations

Tools

Cloud SIEM

UEBA

EDR

SOAR

Data lake

Job description

NSD International, Inc. is seeking a Cyber Security Engineer specializing in Threat Detection to join a high-performing Security Operations team.

You will build, tune, and maintain detections across cloud and on-prem environments to proactively identify, investigate, and respond to threats, applying detection-as-code, automation, and analytics. Collaborate with analysts, incident responders, threat intel, and technology partners to translate threats into actionable detection strategies, develop