Position Title:Detection Engineer III
Department:IT Information Security
Job Description:The Detection Engineer III is a subject matter expert which will lead the development of cutting-edge detection capabilities to defend against the most advanced and persistent cyber threats. You will design and implement highly sophisticated detection frameworks, leveraging deep knowledge of attacker tactics, techniques, and procedures (TTPs) as well as industry-leading tools such as SIEM, EDR, and custom-built solutions.
Your expertise will drive the creation of robust detection rules, threat models, and behavioral analytics that span diverse environments, including cloud, hybrid, and on-premises infrastructures. In addition to leading proactive threat hunting initiatives, you will perform advanced analysis of malicious artifacts, reverse-engineer malware, and provide guidance on mitigating emerging threats.
In this strategic role, you will collaborate with cross-functional teams to align detection engineering with organizational security objectives. You will also establish best practices, refine detection processes, and mentor teams to elevate their technical capabilities. As a recognized expert, you will influence organizational security strategy, enhance incident response capabilities, and contribute to the industry through thought leadership and innovation.
Essential ResponsibilitiesResponsibilities listed in this section are core to the position. Inability to perform these responsibilities with or without an accommodation may result in disqualification from the position.
- Lead Detection Engineering Development. Design and implement advanced detection frameworks and capabilities to defend against persistent and sophisticated cyber threats.
- Create Robust Detection Rules and Models. Develop and optimize detection rules, threat models, and behavioral analytics for diverse environments, including cloud, hybrid, and on-premises infrastructures.
- Leverage Industry-Leading Tools. Utilize tools such as SIEM, EDR, and custom-built solutions to enhance detection accuracy and efficiency across complex infrastructures.
- Analyze Attacker Tactics and Techniques. Apply in-depth knowledge of attacker TTPs to inform detection strategies and improve threat identification and mitigation processes.
- Conduct Proactive Threat Hunting. Lead proactive threat hunting initiatives to uncover hidden threats and vulnerabilities using hypothesis-driven techniques and behavioral analysis.
- Perform Advanced Malware Analysis. Reverse-engineer malware, analyze malicious artifacts, and provide actionable guidance to mitigate and respond to emerging threats.
- Enhance Incident Response Readiness. Collaborate with incident response teams to refine processes, improve response capabilities, and align detection outputs with remediation efforts.
- Establish and Refine Best Practices. Develop and implement best practices for detection engineering, ensuring alignment with organizational security objectives and industry standards.
- Mentor and Develop Team Capabilities. Provide technical mentorship and guidance to elevate the skills of team members and foster a culture of continuous improvement.
- Collaborate Across Functional Teams. Partner with cross-functional teams, including IT, DevOps, and threat intelligence, to align detection capabilities with broader security strategies.
- Contribute to Security Strategy and Innovation. Influence organizational security strategies by driving innovation in detection capabilities and contributing thought leadership within the industry.
- Develop Strategic Documentation and Reporting. Create detailed documentation of detection frameworks, methodologies, and playbooks, and provide strategic insights through technical reporting and communication with stakeholders.
General Responsibilities- Performs other duties as assigned.
Minimum QualificationsEducation Requirements: Bachelor's Degree required.
Experience Requirements:- 5 or more years of experience as a Cybersecurity Engineer required.
- 7 or more years of relevant IT experience required.
License/Certification/Registration Requirements:
- Upper tier security or Cybersecurity Operations certification (e.g. CISSP, GSEC, or CISM) required or obtained within 36 months from hire date.
- Other industry certifications in Cybersecurity Operations or IT security (e.g. GIAC) are highly desirable.
Knowledge/Skills/Abilities Required: - Expertise in developing, testing and fine-tuning detection rules and signatures for tools such as SIEM, IDS/IPS and EDR platforms to detect malicious activities and anomalies.
- Expertise in conducting proactive threat hunting using advanced techniques and tools to identify hidden threats, unknown vulnerabilities and anomalous behavior across networks and endpoints.
- Expert knowledge of scripting languages (Python, PowerShell, Bash, etc.) to automate detection workflows, data collection and analysis processes, enhancing the efficiency and accuracy of threat detection.
- Expertise in analyzing large volumes of security data, including log files and network traffic and correlating disparate data sources to identify patter indicative of malicious activity.
- Expert knowledge of adversary TTPs and frameworks like MITRE ATT&CK to develop and refine detection capabilities tailored to specific threat scenarios and attack vectors.
- Expertise in configuring, tuning, and managing SIEM tools (e.g., Splunk, QRadar, Elastic Stack) and network monitoring tools (e.g., Zeek, Suricata).
- Expert ability to develop and refine detection rules, signatures, and alerts for IDS/IPS, EDR, and SIEM systems based on emerging threats and attack patterns.
- Expert skills in conducting proactive threat hunting using hypothesis-driven investigations and identifying anomalies in network traffic, logs, and endpoint activity.
- Expertise integrating CTI feeds with detection tools, enriching alert context, and correlating threat intelligence with internal security events.
- Expert proficiency in Python, PowerShell, or Bash for developing detection scripts, automating repetitive tasks, and integrating tools within the security stack.
- Expertise in using SQL, regular expressions, and custom query languages (e.g., SPL for Splunk) to search, filter, and analyze large datasets for potential threats.
- Expertise in developing and managing detection content libraries, including playbooks, runbooks, and detection use cases tailored to organizational risks.
- Continuous research and learning to stay current with emerging threats, detection methodologies, and adversary behaviors to enhance detection capabilities.
- Ability to coach, guide and mentor team members.
Current OU Health Employees - Please click HERE to login. 
