Security Detection Engineer

About The Role In this role, you will work at the intersection of network security, data science, and software engineering, focusing on developing detection logic against real-world telemetry. You will treat detections as code, meaning they will be version-controlled, peer-reviewed, tested, measured, and continuously improved to maximize true-positive coverage while reducing false positives.

You will primarily work with network telemetry, including NetFlow, DNS queries, TLS certificate data, SMB filenames, and other L7 metadata extracted from firewall connection records. Over time, you will also help evolve detection capabilities as the platform incorporates endpoint and identity signals.

Responsibilities

• Design and build behavioral models to detect malicious activity and identify meaningful anomalies in network behavior
• Develop detections for attack techniques such as beaconing, DGA, data staging, lateral movement, DNS tunneling, scanning, port hopping, and unusual remote administration activity
• Translate concrete detection use cases into production-ready detection logic, signatures, and behavioral indicators
• Collaborate with threat intelligence teams, including Cisco Talos, to convert emerging threat research into actionable detection content
• Build, evaluate, and continuously tune detections using efficacy metrics such as precision, recall, false-positive rate, and MITRE ATT&CK coverage
• Use production-scale telemetry on Databricks to validate and improve detection performance
• Work with engineering teams to productionize detections as part of a SaaS service, with potential deployment to on-premise environments
• Support threat hunting, investigations, and triage activities with detection expertise
• Use threat intelligence platforms and OSINT sources to enrich detections with current threat context, reputation data, and IOCs
• Apply networking and network security knowledge to model traffic behavior and create precise, low-noise detection logic
• Document detection methodology, assumptions, tuning decisions, and share knowledge across security and engineering teams

Requirements

• Proven experience developing code-like detection content for network threats, including rule-based, signature-based, or behavioral detections
• Strong knowledge of networking and network security, including TCP/IP, DNS, HTTP/S, TLS, SSH, traffic analysis, network architecture, and common attack vectors
• Coding or scripting proficiency for detection development and data analysis, especially with Python and SQL
• Experience with rule languages or detection formats such as Sigma, Snort, Suricata, or similar
• Practical experience applying AI/ML techniques to security detection, including anomaly detection, classification, or behavioral modeling
• Experience with SecOps workflows, including threat hunting, incident investigation support, and improving detections based on operational findings
• Experience using threat intelligence tools, feeds, and OSINT sources to enrich and contextualize detection logic
• Familiarity with detection frameworks such as MITRE ATT&CK and mapping detections to adversary tactics and techniques
• Experience with NDR platforms, security analytics, or SIEM solutions
• Strong analytical and problem-solving skills, with high attention to detail
• Clear documentation and cross-team communication skills
• Endpoint security experience is a strong plus, but not mandatory

SoftServe is an equal opportunity employer. Qualified applicants will receive consideration regardless of race, color, ancestry, ethnicity, national origin, religion, sex, sexual orientation, gender identity or expression, age, citizenship, disability, health condition, marital or family status, veteran status, or any other characteristic protected by applicable law.