Sr. Detection Engineer

We need to output HTML fragment with sections: About the role? Actually the job description includes many paragraphs. We need to use

for section headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title as heading. No Job ID. Remove boilerplate like EEO, equal-opportunity, scam-warning, navigation, cookie, legal, application instructions. Also remove duplicated lines. We need to preserve all substantive information. So we need to extract content and map to sections. Let's parse the job description. First paragraph: "At Cboe, we inspire our people to solve complex challenges together because what we do matters. We provide the financial infrastructure that powers the global economy. As a leading provider of market infrastructure and tradable products, Cboe delivers cutting-edge trading, clearing and investment solutions to market participants around the world. We’re building inclusive ways to support professional and personal development while strengthening the trust we’ve earned as a global market leader. Our teams are empowered to share ideas, actively pursue them and bring on a challenge. As champions of internal mobility and access to opportunity, we encourage our people to “go for it” and equip our managers with the training to coach their teams to the next level. Our Associate Resource Groups champion diversity, equity and inclusion, giving associates a safe space to network, share ideas and create opportunities. Sound like the place for you? Join us!" That's about the company, could be "About the role"? Actually "About the role" is more about the job. But we have a separate "The Security Operations team is hiring a Senior Detection Engineer." Then description of role. So we could have "About the role" containing that overview. Then "The Senior Detection Engineer is a hands-on individual contributor..." That's responsibilities. Then list of responsibilities: "In this role you’ll be responsible for:" followed by bullet list (though not bullet but sentences). We'll need to convert to

• . Then "The ideal candidate has:" bullet list of qualifications. Then "You’ll really stand out with:" bullet list of preferred qualifications. Then "Benefits And Perks" section with details. Then "More About Cboe" maybe not needed? Could be part of About the role? But we can include as "About Cboe" maybe not required heading. The instruction says use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can include About the role, Responsibilities, Requirements (maybe ideal candidate), Qualifications (maybe you’ll really stand out with?), Skills (maybe not separate), Benefits, Pay (salary range), Schedule (maybe not present). We need to include only sections with real specific content. We have salary range: "The anticipated base salary range for this role is $130,900-$169,400". That's Pay. We have Benefits And Perks: list. We have schedule? Not explicit. There's "Flexible, hybrid work environment". That could be Schedule? But schedule heading is for work schedule details like full-time, remote, etc. We could include Schedule if we have info: "Flexible, hybrid work environment". That's schedule info. So we can include Schedule section. We also have "Requirements" maybe combine ideal candidate and you’ll really stand out with? The instruction: Use headings for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can have Requirements (mandatory) and Qualifications (preferred) or Skills. We'll decide. We need to avoid filler like "commensurate with experience". Not present. We must not include boilerplate like EEO, visa sponsorship, etc. Remove those lines. Also remove "Any communication from Cboe regarding this position will only come from a Cboe recruiter..." etc. That's boilerplate. Also remove "Equal Employment Opportunity" etc. Also remove "Learn more about life at Cboe on our website and LinkedIn." maybe not needed but could be part of About Cboe? Might be considered boilerplate. Safer to remove. Also remove "More About Cboe" paragraph maybe not needed but could be considered About the role? It's generic. Might be considered filler. I'd remove. Now construct HTML. We'll start with

  About the role

  then

  containing company overview and role intro. Then

  Responsibilities

  then
  • each responsibility. Then

    Requirements

    then
    • ideal candidate bullet points. Then

      Qualifications

      then
      • you’ll really stand out with bullet points. Then

        Benefits

        then
        • benefits list. Then

          Pay

          then

          salary range. Then

          Schedule

          then

          flexible hybrid work environment. We need to ensure we don't duplicate content. Let's extract responsibilities list exactly as given: "In this role you’ll be responsible for:" then list: - Writing, tuning, and maintaining production detection logic across SIEM, EDR, identity, and cloud platforms, with explicit attention to fidelity and false positive cost - Validating every detection by executing the technique it targets, so that no rule reaches production unproven - Building and maintaining internal tooling that simulates adversary behavior on demand, making detection testing repeatable rather than manual - Building reusable validation packages and automated regression testing so coverage is re-verified continuously and after every agent, platform, or configuration change - Building and operating sandbox and detonation infrastructure, including disposable, instrumented environments for exploit triage, malware analysis, and safe technique development - Evaluating newly published proof-of-concept exploit code to determine whether it functions, what telemetry it generates, and whether Cboe is exposed, then converting the answer into detection or hunting content - Producing threat hunting validation content, including seeded artifacts, known-truth datasets, and repeatable test cases that establish whether a hypothesis is testable with the data we hold - Automating the repeatable work: scheduled technique execution, telemetry collection, coverage reporting, and detection performance measurement - Applying AI and LLM tooling where it measurably shortens cycle time, including agentic workflows for triage and enrichment, automated analysis of exploit and malware code, detection and test-case drafting, and hunt hypothesis generation - Conducting security testing of internally built web applications and APIs, and translating findings into detection requirements as well as remediation guidance - Supporting Incident Response during complex investigations with concrete attacker tradecraft insight, and closing the loop by building detections for what the investigation surfaces - Documenting and handing off work so that tooling, environments, and test content can be operated by others independently We'll make each a

        • . Now Requirements (ideal candidate): - 5+ years of hands-on security engineering experience with substantial detection authoring content, and the ability to speak concretely about detections you built, how you validated them, and how they performed in production - Strong command of at least one detection query language (KQL, Sigma, YARA-L, or equivalent) and the judgment to recognize when logic is too brittle or too broad to ship - Practical knowledge of attacker techniques across Windows and Active Directory, Entra ID, cloud platforms (AWS, Azure), SaaS, and containerized workloads, at the level of execution mechanics rather than technique names - The ability to read unfamiliar exploit or malware code and identify the observable artifacts worth detecting on - Real fluency in at least one language used to write tooling (Python, Go, C#, PowerShell, bash, or equivalent - Working knowledge of the telemetry itself, including Windows event logs, EDR process and network events, cloud audit logs, and identity sign-in data, and where each is unreliable, incomplete, or trivially evaded - Comfort building and tearing down test infrastructure using virtualization, containers, infrastructure-as-code, and CI/CD - A disciplined approach to false positives, alert quality, and the operational burden that detections place on analysts - Clear technical writing aimed at engineers, including detection documentation and analyst-facing response guidance - High ethical standards and demonstrated discipline around authorization, scope, blast radius, and handling of sensitive data - Bachelor’s degree or equivalent practical experience Note: Some lines have missing closing parentheses? We'll keep as is. Now Qualifications (you’ll really stand out with): - Public detection content, tooling, or research that we can review - Hands-on experience with atomic testing frameworks or continuous control validation at scale - Use of MITRE ATT&CK as a coverage and gap-analysis instrument rather than a reporting label - Concrete AI engineering experience, such as agentic workflows, tool and MCP integration, or testing LLM-application abuse cases including prompt injection - Reverse engineering, Windows internals, or EDR telemetry and evasion research - Experience operating in regulated or large enterprise environments, especially financial services - A track record of mentoring engineers or building internal training material - Curiosity, adaptability, and a continuous improvement mindset Now Benefits list from "Benefits And Perks" paragraph: We need to extract bullet points: - Fair and competitive salary and incentive compensation packages with an upside for overachievement - Generous paid time off, including vacation, personal days, sick days and annual community service days - Flexible, hybrid work environment - Health, dental and vision benefits, including access to telemedicine and mental health services - 2:1 401(k) match, up to 8% match immediately upon hire - Discounted Employee Stock Purchase Plan - Tax Savings Accounts for health, dependent and transportation - Employee referral bonus program - Volunteer opportunities to help you give back to your communities - Complimentary lunch, snacks and coffee in any Cboe office - Paid Tuition assistance and education opportunities - Generous charitable giving company match - Paid parental leave and fertility benefits - On-site gyms and discounts to other fitness centers Note: "Flexible, hybrid work environment" also appears as schedule; we might duplicate but okay. Now Pay: salary range: $130,900-$169,400 base salary, plus annual incentive compensation and long-term equity programs. We'll include that. Now Schedule: maybe we can note "Flexible, hybrid work environment". Already in benefits but we can still include schedule. We must avoid duplication? Not strictly prohibited but better to avoid repeating same sentence. We could keep schedule separate and not duplicate in benefits. But benefits list includes that line; we could keep it there and schedule maybe just mention "Flexible, hybrid work environment". It's okay if duplicate but better to avoid. Let's keep schedule separate and maybe remove from benefits? But benefits list includes many items; we could keep schedule separate and keep benefits without that line. However the instruction says preserve ALL substantive information; we can't remove the flexible hybrid work environment from benefits because it's a benefit. But we could keep it in benefits and also schedule; duplication is not prohibited but might be considered redundant. I'd keep it in benefits and also schedule? Might be okay but we could note schedule as "Flexible, hybrid work environment" and keep benefits without that line? That would lose that benefit from benefits list. But the benefit is still present in schedule section; still preserved. So we can move it to schedule and remove from benefits to avoid duplication. That preserves the info. Let's do that. Thus benefits list will exclude "Flexible, hybrid work environment". We'll keep other benefits. Now schedule section:

          Flexible, hybrid work environment

          . Now About the role: need to include company overview and role intro. Let's craft a paragraph: "At Cboe, we inspire our people to solve complex challenges together because what we do matters. We provide the financial infrastructure that powers the global economy. As a leading provider of market infrastructure and tradable products, Cboe delivers cutting-edge trading, clearing and investment solutions to market participants