Detection Engineer - Remote

Detection Engineering (Core Focus) Design and develop custom detection rules from scratch using endpoint, network, and cloud telemetry Translate MITRE ATT&CK techniques into actionable detection logic Build detections based on: Process execution patterns Command-line analysis Parent-child relationships DLL loads and memory behaviors Network anomalies

Threat Behavior Modeling Analyze attacker tactics, techniques, and procedures (TTPs) Convert threat intelligence into practical detection use cases Continuously refine detections to reduce false positives

Detection Implementation Implement detection logic across platforms such as: Microsoft Defender for Endpoint CrowdStrike Falcon SentinelOne SIEM tools (e.g., Microsoft Sentinel, Splunk) Work with: KQL (Kusto Query Language) Sigma rules EDR custom detection frameworks

Threat Hunting & Validation Proactively hunt for threats using hypothesis-driven approaches Validate detection rules through: Simulated attack scenarios Red team / purple team exercises

Continuous Improvement Tune detection rules for: Accuracy Performance Scalability Eliminate alert fatigue by improving signal-to-noise ratio

Collaboration Work closely with: SOC Analysts (for feedback loop) Incident Response teams Threat Intelligence teams Provide guidance on detection coverage gaps

Must-Have Skills
Technical Expertise
Strong experience in EDR/XDR platforms:
Microsoft Defender for Endpoint
CrowdStrike
SentinelOne
Hands-on experience writing:
Custom detection rules (non-negotiable)
Log queries using KQL / SPL

Deep Understanding of:
Endpoint telemetry:
Process creation logs
Command-line arguments
File activity
Registry changes
Attack techniques:
Lateral movement
Privilege escalation
Persistence mechanisms
Defense evasion

Frameworks & Methodologies
Strong knowledge of MITRE ATT&CK framework
Experience mapping detections to ATT&CK techniques

Scripting / Automation
Basic to intermediate scripting in:
Python / PowerShell

Promotional text