Senior Threat Engineer

The Senior Threat Engineer designs scalable threat-detection, decisioning, and response workflows, using investigation, automation, and operational data to improve accuracy and reduce manual review. The role requires significant cybersecurity operations experience and strong analytical, communication, and cross-functional collaboration skills.

About the job

Responsibilities

Design, build, and improve detection, decisioning, and response workflows for the Verdict Engine.
Own complex threat-detection and workflow problems from investigation concept through implementation, validation, and iteration.
Translate threat research and investigative reasoning into scalable detections, enrichment, triage logic, and automated decisions.
Analyze operational data to identify false positives, false negatives, latency issues, and opportunities to improve workflow categories.
Increase system autonomy, reducing manual review while improving service quality and consistency.
Support complex or novel cases and incorporate lessons into future automated handling.
Improve the clarity, accuracy, and calibration of customer-facing outputs.
Identify customer pain points and use those insights to improve verdict logic, response content, and product behavior.
Partner with product, engineering, and security teams on platform capabilities, data quality, and operational leverage.
Define best practices, operating principles, and technical standards for Threat Engineering.
Document detection concepts, workflow logic, and operating principles.
Provide technical leadership through execution, judgment, and mentorship.

Requirements

Significant cybersecurity operations experience in threat detection and response, detection engineering, incident response, threat hunting, or SOC operations.
Strong investigative and analytical skills, including the ability to convert ambiguous signals into practical detection logic and workflow improvements.
Experience building, tuning, or maintaining security automations, detections, playbooks, rules, or enrichment pipelines.
Ability to independently own complex technical or operational problem areas and drive improvements through ambiguity.
Strong written and verbal communication skills, including documenting logic and explaining threats, tradeoffs, and outcomes.
Ability to collaborate with product, engineering, and security stakeholders.
Comfort using data to evaluate detection quality and workflow performance.
Preference for simple, scalable solutions that reduce unnecessary complexity and manual work.

Nice-to-haves

Experience in high-volume security operations environments.
Experience with SIEM, EDR, SOAR, case management, and telemetry enrichment systems.
Scripting or query-writing experience for investigations, automation, or workflow analysis.
Experience improving operational quality through experimentation, measurement, and continuous iteration.
Experience in workflow design, detection engineering, automation, or security product development.
Experience mentoring engineers, setting technical direction, or influencing detection and response practices.

Benefits

100% medical coverage, including outpatient care.
Life insurance.
25+ paid holidays.
Annual home office stipend.
7% employer pension contribution.
Mental and physical health wellness programs.
Competitive compensation and advancement opportunities.

Skills

Threat Detection, Incident Response, Threat Hunting, Soc Operations, Detection Engineering, Security Automation, SIEM, Edr, Soar, Playbooks, Security Enrichment Pipelines, Scripting, Query Writing, Workflow Design, Telemetry