Threat Defense Engineer

About the role

The Threat Defense Engineer is responsible for engineering, implementing, optimizing, and maturing the technologies and technical processes that support Fortified’s managed security services. Operating within a multi-client Managed Security Service Provider (MSSP) environment, the Engineer serves as a subject matter expert across SIEM, EDR/MDR, IoMT, DLP, cloud, network, identity, and other security technologies used in service delivery. The role focuses on security platform health, detection engineering, telemetry and log management, technical troubleshooting, automation, standardization, and resolving complex service-impacting issues. The Engineer works closely with clients, Security Operations, Threat Hunting, Incident Response, internal engineering teams, and technology vendors to ensure services are scalable, reliable, repeatable, and effective. The role also supports client onboarding, technical meetings, architecture discussions, training, and pre- and post-sales activities, with a focus on driving security, standardization, efficiency, and continuous service improvement.

Responsibilities

• Provide deep technical understanding of tools and processes used to support the delivery of Fortified’s managed services.
• Engineer, implement, configure, maintain, and optimize SIEM, EDR/MDR, IoMT, DLP, cloud, network, identity, and related security technologies.
• Partner with clients on onboarding, implementation, configuration, service health reviews, and technical improvements across supported lines of business.
• Partner with clients on service implementation and delivery of all LOBs including but not limited to: Managed SIEM, EDR, IoMT, & DLP
• Support multi-tenant MSSP environments by promoting standardized, repeatable configurations while accounting for documented client-specific requirements.
• Monitor and maintain the health, availability, performance, connectivity, and effectiveness of security platforms and integrations.
• Troubleshoot complex issues involving agents, APIs, collectors, log forwarding, authentication, networking, integrations, and security data pipelines.
• Provide guidance on log source ingestion, parsing, normalization, filtering, retention, validation, and telemetry quality.
• Design, create, test, tune, and maintain detections, correlation rules, suppression logic, exclusions, watchlists, and other security content.
• Analyze alert volume, false positives, and detection performance to improve actionable security coverage without reducing necessary visibility.
• Perform advanced technical investigations and root cause analysis for security platform issues, escalations, detection gaps, and service-impacting events.
• Develop scripts, API integrations, automation, and internal tooling to improve operational efficiency and reduce repetitive manual processes.
• Create reusable engineering standards, configuration baselines, templates, and workflows that improve scalability and consistency across the client base.
• Validate security telemetry and detection coverage to identify