Threat Detection Engineering Lead

The Carlyle Group; Washington (District of Columbia); Hybrid; USD 160,000 - 180,000; Full time

Job summary

The Carlyle Group is seeking a Threat Detection Engineer to lead detection engineering and threat intelligence efforts, turning intelligence into production detections and guiding automation and platform reliability. This hands-on leadership role partners with security teams to improve detection coverage and incident response.

In-office requirement: 4 days per week. The role emphasizes building scalable detection content across endpoints, cloud and identity, with a focus on reducing false

Qualifications

• Bachelor’s degree, required.
• 4+ years of hands-on experience spanning threat detection engineering and cyber threat intelligence.
• Experience creating production detections and using intelligence to improve detection, hunting or response.

Responsibilities

• Own the detection content lifecycle from requirements through testing, deployment, tuning and retirement.
• Develop high-fidelity detections across endpoint, identity, email, network, cloud and business-critical application telemetry.
• Translate adversary behaviors and threat intelligence into testable detection hypotheses and production-ready analytics.
• Implement quality gates for detection content and use detection-as-code for internally managed content.
• Coordinate targeted threat hunts with incident response to validate hypotheses and improve detections.
• Review technical work and coach contributors on detection design, testing and investigative usability.

Skills

Threat detection engineering

AI-assisted tools

Cross-functional collaboration

Incident response

Education

Bachelor’s degree

Cybersecurity-related field

Advanced degree preferred

Tools

Sigma

KQL

SPL

YARA-L

EQL

SQL

Job description

The Carlyle Group is seeking a Threat Detection Engineer to lead detection engineering and threat intelligence efforts, turning intelligence into production detections and guiding automation and platform reliability. This hands-on leadership role partners with security teams to improve detection coverage and incident response.

In-office requirement: 4 days per week. The role emphasizes building scalable detection content across endpoints, cloud and identity, with a focus on reducing false