Threat Researcher -Cloud & Endpoint Detection

Lead design, implementation, testing, and tuning of detection content covering endpoint, network, cloud, identity, and email telemetry within XDR integrations.

Develop and maintain high-value, generalized detections from third-party security provider data for broad Extended Detection and Response (XDR) coverage.

Provide technical guidance to developers and collaborate cross-functionally to maximize operational detection coverage and improve detection efficacy.

4+ years experience in Detection Engineering, Threat Hunting, Security Research, SOC Engineering, or Security Analytics.

Expert-level Python skills for building detection tooling, automation, and frameworks.

Strong knowledge of diverse security telemetry sources including endpoint logs, network telemetry, cloud platform logs, identity provider logs, and email security data.

Experience with detection analytic languages (e.g., KQL, SPL, Sigma, SQL) and building detections using multi-domain telemetry from cloud, endpoint, identity, or security platforms.

Broad expertise across multiple telemetry domains (endpoint, cloud, identity, email, network) with the ability to design cross-domain, generalized detection strategies.

Comfortable analyzing new third-party integrations rapidly to develop actionable detection coverage from unfamiliar security data schemas and APIs.

Experienced in providing technical leadership, influencing detection strategies, and scaling detection content across a large XDR ecosystem.