شرح موقعیت
We are seeking an experienced Senior Threat Detection Engineer to design, develop, test, and optimize security detection capabilities across networks, endpoints, and applications. The ideal candidate will have strong expertise in threat detection engineering, threat hunting, threat intelligence, detection-as-code, and security analytics, with the ability to translate adversary tactics and techniques into actionable detection strategies. The role involves collaborating with Security Operations, Incident Response, and Threat Intelligence teams to improve detection coverage, reduce false positives, and strengthen the organization's overall security posture. Key Responsibilities Detection Engineering: Design, develop, test, and fine-tune detection rules across networks, endpoints, cloud environments, and applications to identify suspicious activities and potential threats. Threat Intelligence Integration: Translate threat intelligence, adversary tactics, techniques, and procedures (TTPs) into actionable detection use cases and proactive threat-hunting strategies. Detection Content Development: Develop, maintain, and optimize detection content using tools and technologies such as Sigma, YARA, Elasticsearch, and Python. Alert Investigation and Optimization: Investigate security alerts to understand attacker behavior, identify detection gaps, improve detection logic, and enhance overall detection effectiveness. Cross-Functional Collaboration: Work closely with Incident Response, Threat Intelligence, Security Monitoring, and SOC teams to improve detection quality, reduce false positives, and strengthen incident investigation capabilities. Threat Research: Research emerging malware, attack techniques, adversary behaviors, and industry-specific cyber threats to continuously improve detection coverage. MITRE ATT&CK Mapping: Map detection rules, threat-hunting hypotheses, and security use cases to the MITRE ATT&CK framework to measure coverage and identify gaps. Defense-in-Depth Detection: Develop layered detection strategies to identify the same attack techniques across multiple telemetry sources and security controls, ensuring comprehensive visibility and resilience against evasion. Code and Content Reviews: Review team members' detection code, rule logic, test cases, and documentation to maintain high standards of quality, consistency, and reliability. Detection-as-Code: Strengthen Detection-as-Code practices through version control, automated testing, validation pipelines, peer reviews, and standardized documentation. Continuous Improvement: Identify opportunities to improve detection engineering workflows, security analytics, threat-hunting methodologies, and detection coverage across multiple industry sectors. Required Technical Skills Strong knowledge of threat detection engineering, threat hunting, and adversary behavior analysis. Hands-on experience developing and maintaining detection rules using Sigma and YARA. Experience with Elasticsearch and security analytics platforms for querying and investigating security telemetry. Proficiency in Python for detection automation, data processing, testing, and rule validation. Understanding of the MITRE ATT&CK framework, including tactics, techniques, and procedures. Experience with Detection-as-Code principles, version control, automated testing, and CI/CD workflows. Knowledge of endpoint, network, application, and cloud security telemetry. Experience investigating security alerts, analyzing false positives, and identifying detection blind spots. Understanding of defense-in-depth principles and layered security detection strategies. Strong analytical, problem-solving, communication, and collaboration skills.