Detection Engineering: Design, develop, and maintain high-fidelity detections across Splunk, Snowflake, and related platforms.

Content Development: Author SPL-based detections (Splunk) and SQL-based queries (Snowflake, MySQL, PostgreSQL, SQL Server).

Snowflake Engineering:

• Design and optimize queries within Snowflake for detection logic and threat hunting.

• Configure and maintain Snowpipe pipelines for real-time and batch ingestion of security-relevant data.

• Partner with data engineering to ensure schema design and ingestion pipelines support scalable detection use cases.

Pipeline Engineering (Future State):

• Design and maintain integrations with Cribl/Databahn (or similar platforms) for log routing, transformation, and observability pipeline efficiency, telemetry enrichment, normalization, and cost-optimized data movement.

Platform Administration: Provide administrative expertise for Splunk and Snowflake environments,ensuring resilience, scalability, and performance.

Threat Modeling & Framework Alignment: Map detections to the MITRE ATT&CK framework to ensure comprehensive threat coverage.

Anvilogic-Driven Detection Engineering:

• Use detection-as-code workflows for structured creation, testing, and deployment of detections.

• Leverage Anvilogic content packs and extend/customize them for organization-specific threats.

• Orchestrate multi-platform detection deployment across Splunk, Snowflake, and other SIEM/data lake platforms.

• Apply coverage analytics within Anvilogic to identify detection gaps and validate against MITRE ATT&CK.

• Manage the full lifecycle of detections including creation, validation, deployment, tuning, and retirement within Anvilogic.

• Collaborate with SOC and IR teams to streamline workflows and reduce false positives using Anvilogic-driven integration.

Regulatory Alignment: Engineer detection solutions with compliance in mind (e.g., PCI-DSS, HIPAA, SOX, GLBA).

Collaboration: Partner with SOC, IR,Threat Intel, Red/Purple, Continuous Security Validation,andDataEngineering teams to validate detections, minimize false positives, and strengthen visibility.

• 5+ years of experience in detection engineering, threat engineering, or a related security role

• Strong expertise in Splunk SPL and detection development

• Proficiency with SQL (MySQL, PostgreSQL, SQL Server)

• Hands-on experience with Snowflake, including:

• Authoring SQL-based detections and threat hunts

• Designing and managing Snowpipe pipelines for security data ingestion

• Proven Splunk and Snowflake administration experience

• Demonstrated ability to align detections to the MITRE ATT&CK framework

• Experience operating in highly regulated industries

• Hands-on experience with Anvilogic (detection-as-code, orchestration, coverage analytics, lifecycle management)

• Hands-on experience with Cribl/Databahn or similar for log routing, enrichment, and observability pipelines cost-optimized telemetry and data engineering integration

• Relevant certifications: Splunk Certified Architect, SnowPro Core/Advanced, GIAC (GCDA, GCED, etc.)

• Bachelor’s degree and three years of experience in systems engineering or administration or an equivalent combination of education and work experience

• Deep specialized and/or broad functional knowledge in applied enterprise information security technologies

• Previous experience in leading complex IT projects

• Experience with No-Code/Low-Code SecurityDetection Engineeringtools

• Python development experience

• Banking or financial services experience

• Docker, Kubernetes, containerization pipeline, and deployment experience

• Other security certifications (e.g. GSEC, GCED, GPPA, etc.)

• Experience operationalizing Cyber use cases with LargeLanguageModels(LLMs)