Threat Detection Engineer - Detection-as-Code (On-site Utah)

BuddoBot Inc.; Ogden (UT); On-site; USD 100,000 - 160,000; Full time

Job summary

Dark Wolf is seeking a Threat Detection Engineer to design, build, test, and deploy detection logic across on-premise and AWS GovCloud environments, applying a Detection-as-Code approach to create high-fidelity alerts, automate responses, and reduce alert fatigue. The role centers on proactive threat hunting, ML-assisted detection development, and integration with GitLab pipelines.

This is an on-site position at Hill AFB in Ogden, Utah.

Qualifications

• 4+ years of relevant experience in threat detection or security engineering.
• Hands-on Splunk Enterprise and ELK Stack tuning and use.
• Experience applying DoD cybersecurity requirements and A&A activities.
• Experience in a vSOC, SOC, or CSSP responding to incidents.
• Experience ingesting AWS GovCloud security telemetry and on-prem logs.
• GitLab for Detection-as-Code and CI/CD workflows.
• DoDD 8140 CSSP certification or equivalent before hire.
• Bachelor's degree in CS/IT or related field.
• US Citizenship with active Top Secret/SCI clearance.

Responsibilities

• Design, build, test, and deploy detection logic across on-prem and AWS GovCloud.
• Write and maintain detection signatures for cloud vectors, containers, and hosts.
• Ingest and analyze CloudTrail, VPC logs, GuardDuty, Config, EKS logs and on‑prem telemetry.
• Proactively hunt for threats mapped to MITRE ATT&CK Cloud Matrix.
• Collaborate with NOSC and AWS engineers to develop automated remediation in GitLab CI/CD.
• Root-cause analysis on false positives/negatives to improve alert fidelity.
• Leverage AI-assisted analysis to improve query generation and threat intelligence correlation.
• Contribute to DCO concepts of operations, processes, and procedures.
• Support vulnerability management, adhere to BSTG policies and training.
• Participate in developing DCO TTPs, threat models, and documentation.

Skills

Threat detection engineering

Splunk Enterprise

ELK Stack

SOC/CSSP experience

GitLab & CI/CD

DoD compliance knowledge

Security clearance eligibility

Education

Bachelor's degree in Computer Science / IT

Tools

GitLab

AWS GovCloud

Terraform / CloudFormation

CloudTrail / GuardDuty / EKS Logs

Job description

Dark Wolf is seeking a Threat Detection Engineer to design, build, test, and deploy detection logic across on-premise and AWS GovCloud environments, applying a Detection-as-Code approach to create high-fidelity alerts, automate responses, and reduce alert fatigue. The role centers on proactive threat hunting, ML-assisted detection development, and integration with GitLab pipelines.

This is an on-site position at Hill AFB in Ogden, Utah.