Detection Engineer III

OU Health is an equal opportunity employer offering a comprehensive benefits package that includes PTO, 401(k), medical, and dental plans.

About the role

The Detection Engineer III is a subject matter expert who will lead the development of cutting-edge detection capabilities to defend against the most advanced and persistent cyber threats. You will design and implement highly sophisticated detection frameworks, leveraging deep knowledge of attacker tactics, techniques, and procedures (TTPs) as well as industry-leading tools such as SIEM, EDR, and custom-built solutions. Your expertise will drive the creation of robust detection rules, threat models, and behavioral analytics that span diverse environments, including cloud, hybrid, and on-premises infrastructures.

In this strategic role, you will collaborate with cross-functional teams to align detection engineering with organizational security objectives, establish best practices, refine detection processes, and mentor teams to elevate their technical capabilities. As a recognized expert, you will influence organizational security strategy, enhance incident response capabilities, and contribute to the industry through thought leadership and innovation.

Responsibilities

• Lead Detection Engineering Development: Design and implement advanced detection frameworks and capabilities to defend against persistent and sophisticated cyber threats.
• Create Robust Detection Rules and Models: Develop and optimize detection rules, threat models, and behavioral analytics for diverse environments, including cloud, hybrid, and on-premises infrastructures.
• Leverage Industry-Leading Tools: Utilize tools such as SIEM, EDR, and custom-built solutions to enhance detection accuracy and efficiency across complex infrastructures.
• Analyze Attacker Tactics and Techniques: Apply in-depth knowledge of attacker TTPs to inform detection strategies and improve threat identification and mitigation processes.
• Conduct Proactive Threat Hunting: Lead proactive threat hunting initiatives to uncover hidden threats and vulnerabilities using hypothesis-driven techniques and behavioral analysis.
• Perform Advanced Malware Analysis: Reverse-engineer malware, analyze malicious artifacts, and provide actionable guidance to mitigate and respond to emerging threats.
• Enhance Incident Response Readiness: Collaborate with incident response teams to refine processes, improve response capabilities, and align detection outputs with remediation efforts.
• Establish and Refine Best Practices: Develop and implement best practices for detection engineering, ensuring alignment with organizational security objectives and industry standards.
• Mentor and Develop Team Capabilities: Provide technical mentorship and guidance to elevate the skills of team members and foster a culture of continuous improvement.
• Collaborate Across Functional Teams: Partner with cross-functional teams, including IT, DevOps, and threat intelligence, to align detection capabilities with broader security strategies.
• Contribute to Security Strategy and Innovation: Influence organizational security strategies by driving innovation in detection capabilities and contributing thought leadership within the industry.
• Develop Strategic Documentation and Reporting: Create detailed documentation of detection frameworks, methodologies, and playbooks, and provide strategic insights through technical reporting and communication with stakeholders.
• Perform other duties as assigned.

Requirements

• Bachelor’s Degree required.
• 5 or more years of experience as a Cybersecurity Engineer required.
• 7 or more years of relevant IT experience required.
• Upper tier security or Cybersecurity Operations certification (e.g., CISSP, GSEC, or CISM) required or obtained within 36 months from hire date.
• Other industry certifications in Cybersecurity Operations or IT security (e.g., GIAC) are highly desirable.

Skills

• Expertise in developing, testing, and fine-tuning detection rules and signatures for tools such as SIEM, IDS/IPS, and EDR platforms to detect malicious activities and anomalies.
• Expertise in conducting proactive threat hunting using advanced techniques and tools to identify hidden threats, unknown vulnerabilities, and anomalous behavior across networks and endpoints.
• Expert knowledge of scripting languages (Python, PowerShell, Bash, etc.) to automate detection workflows, data collection, and analysis processes, enhancing the efficiency and accuracy of threat detection.
• Expertise in analyzing large volumes of security data, including log files and network traffic, and correlating disparate data sources to identify patterns indicative of malicious activity.
• Expert knowledge of adversary TTPs and frameworks like MITRE ATT&CK to develop and refine detection capabilities tailored to specific threat scenarios and attack vectors.
• Expertise in configuring, tuning, and managing SIEM tools (e.g., Splunk, QRadar, Elastic Stack) and network monitoring tools (e.g., Zeek, Suricata).
• Expert ability to develop and refine detection rules, signatures, and alerts for IDS/IPS, EDR, and SIEM systems based on emerging threats and attack patterns.
• Expert skills in conducting proactive threat hunting using hypothesis-driven investigations and identifying anomalies in network traffic, logs, and endpoint activity.
• Expertise integrating CTI feeds with detection tools, enriching alert context, and correlating threat intelligence with internal security events.
• Expert proficiency in Python, PowerShell, or Bash for developing detection scripts, automating repetitive tasks, and integrating tools within the security stack.
• Expertise in using SQL, regular expressions, and custom query languages (e.g., SPL for Splunk) to search, filter, and analyze large datasets for potential threats.
• Expertise in developing and managing detection content libraries, including playbooks, runbooks, and detection use cases tailored to organizational risks.
• Continuous research and learning to stay current with emerging threats, detection methodologies, and adversary behaviors to enhance detection capabilities.
• Ability to coach, guide, and mentor team members.

Benefits

• Paid time off (PTO)
• 401(k) retirement plan
• Medical and dental plans