Threat Detection & Response Engineer

Coalfire; Chicago (IL); Hybrid; USD 80,000 - 134,000; Full time

Benefits offered by this job

Paid parental leave

Certification and training reimburse-

Digital mental health and wellbeing

Comprehensive insurance options

Job summary

Coalfire is hiring a Detection and Response Engineer to join the Defensive Services team in Chicago. You will support SIEM monitoring, threat hunting, and purple team activities to meet federal compliance and commercial security requirements.

Responsibilities include building detection queries across multiple SIEMs, tuning alerts for fidelity, and leading cyclical hunts using threat intelligence and behavior-based analytics. Collaboration and strong communication are essential.

Qualifications

• 2-4 years of experience in large-scale enterprise security environments.
• Hands-on with at least two SIEM platforms in production detection and response.
• Experience monitoring, validating, and escalating SIEM alerts per runbooks and SLAs.
• Ability to investigate security alerts across multiple log sources.
• Experience mapping incidents to MITRE ATT&CK and coordinating with IR teams.

Responsibilities

• Collect and operationalize threat intelligence to drive threat hunts.
• Develop, optimize, and maintain SIEM detection queries across platforms.
• Lead hypothesis-driven threat hunts and update runbooks and telemetry.
• Translate hunt outcomes into detection improvements and dashboards.

Skills

Threat hunting

SIEM

Incident response

Threat intelligence

Detection-as-Code

MITRE ATT&CK mapping

Dashboards

Runbooks

Communication

Documentation

Education

Splunk Enterprise Certified Administrator

Splunk Enterprise Security Certified Administrator

SumoLogic Administrator

Microsoft Security Operations Associate

Elastic Stack Certified Administrator

Tools

Splunk

Microsoft Sentinel

ELK

LogRhythm

Sumo Logic

Job description

Coalfire is hiring a Detection and Response Engineer to join the Defensive Services team in Chicago. You will support SIEM monitoring, threat hunting, and purple team activities to meet federal compliance and commercial security requirements.

Responsibilities include building detection queries across multiple SIEMs, tuning alerts for fidelity, and leading cyclical hunts using threat intelligence and behavior-based analytics. Collaboration and strong communication are essential.