Detection Engineer

Job Overview

ThreatLocker is seeking a Detection Engineer to drive the development and continuous improvement of detection content within the ThreatLocker Detect platform. This role is responsible for creating and maintaining detection rules used by our Endpoint Detection and Response (EDR) and Identity Threat Detection and Response (ITDR) products while ensuring alignment with the MITRE ATT&CK® Framework.

Required Qualifications

• 3+ years of experience in Information Security.
• 2+ years of experience working with Endpoint Detection and Response (EDR) or Identity Threat Detection and Response (ITDR) technologies within an enterprise environment.
• Experience developing detection content is strongly preferred.
• Strong understanding of the MITRE ATT&CK Framework and its application within enterprise security.
• Experience creating custom Sigma, YARA, and Snort detection rules.
• Strong knowledge of Windows operating systems and Windows forensic artifacts.
• Experience with Windows persistence mechanisms, privilege escalation, defense evasion, and parent-child process relationships.
• Familiarity with malware analysis, threat hunting, and vulnerability research.
• Familiarity with adversary emulation and post-exploitation frameworks.
• Strong analytical, troubleshooting, and critical thinking skills.
• Excellent written and verbal communication skills with the ability to explain technical concepts to non-technical stakeholders.
• Able to work independently while collaborating effectively within a team environment.
• Relevant certifications such as OSCP, GCFA, GCIH, GCIA, GCDA, GCTD, or GISP are a plus.

Working Conditions

• Standing, walking, sitting, reaching with hands and arms, climbing or balancing, stooping or kneeling.
• Talking and hearing.
• Using fingers and hands to feel objects and tools.
• Lifting and/or moving up to 25 pounds.
• Close vision, distance vision, depth perception, and the ability to adjust focus.