RemoteLeaf Logo
Log in Sign up

Detection and Response Engineer

2 months, 3 weeks ago
United States
Full-time
Mid Level
Security Analyst
Cybersecurity
Ansible AWS Azure Cybersecurity GCP GitHub GitLab HIPAA SIEM Splunk Terraform
Apply Now
Coalfire

Coalfire

Coalfire is a cybersecurity advisor that helps organizations avert threats, reduce risk, and turn security into a competitive advantage, fueling their success.

Internet Software & Services
251-1K
Founded 2001
$9M raised
View All Jobs 13

Description

  • Collect, analyze, and operationalize threat intelligence to support proactive detection and threat hunting.
  • Develop, optimize, and maintain custom detection and threat-hunting queries across multiple SIEM platforms.
  • Tune alerts, build dashboards, and create saved searches for repeatable operational use cases.
  • Plan and lead cyclical, hypothesis-driven threat hunts using threat intelligence and behavior-based analytics.
  • Identify detection gaps, telemetry blind spots, and data quality issues.
  • Translate hunt and investigation outcomes into improved detections, alert tuning, dashboards, and runbooks.
  • Monitor, validate, and escalate SIEM alerts according to documented runbooks, SLAs, and severity thresholds.
  • Investigate and respond to security alerts across multiple log sources to determine scope, root cause, and impact.
  • Escalate confirmed incidents with timelines, evidence, and MITRE ATT&CK mapping to incident response teams or senior engineers.

Requirements

  • 2–4 years of experience in large-scale enterprise security environments, including cloud-hosted or hybrid infrastructures.
  • Working knowledge of at least one major cloud platform: Azure, AWS, or GCP.
  • Hands-on experience with at least two SIEM platforms such as Splunk, Microsoft Sentinel, ELK, LogRhythm, or Sumo Logic.
  • Experience operating in a production detection and response environment.
  • Experience independently monitoring, validating, and escalating SIEM alerts using runbooks, SLAs, and severity thresholds.
  • Experience conducting structured, cyclical threat hunting using hypothesis-driven and behavior-based methods.
  • Ability to leverage threat intelligence to understand attack chains, threat actor tradecraft, and expected telemetry.
  • Experience developing and maintaining custom detection and threat-hunting queries in at least two SIEM platforms.
  • Experience identifying detection gaps, telemetry blind spots, and data quality issues and turning them into improved detections and documentation.
  • Strong communication, organizational, problem-solving, and documentation skills.
  • Ability to work independently and as part of a team in fast-paced environments.
  • Experience with a Detection-as-Code framework.
  • Experience working in NIST 800-53 environments.
  • At least one required certification: Splunk Enterprise Certified Administrator, Splunk Enterprise Security Certified Administrator, SumoLogic Administrator, Microsoft Security Operations Associate, or Elastic Stack Certified Administrator.
  • Preferred: consulting or professional services background.
  • Preferred: automation experience with GitLab or GitHub using Terraform and Ansible.
  • Preferred: familiarity with FedRAMP, FISMA, HIPAA, HITRUST, PCI, and similar regulatory standards.

Benefits

  • Flexible work model with the ability to work from home or the office.
  • Paid parental leave.
  • Flexible time off.
  • Certification and training reimbursement.
  • Digital mental health and wellbeing support membership.
  • Comprehensive insurance options.
  • Employee resource groups and in-person and virtual events.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

World Business Lenders

Cyber Security Analyst

World Business Lenders 251-1K Real Estate

World Business Lenders is seeking an entry-level Cybersecurity Engineer to protect systems, devices, and information across its fully remote multinational lending organization by monitoring security activity and strengthening security controls.

Turkey Full-time Entry Level Security Analyst
Cybersecurity Linux PowerShell Python SIEM
5 hours, 54 minutes ago
JustMarkets

Security Operations Analyst (L1)

JustMarkets 1-10 Capital Markets

Join a fintech innovation team as a full-time Security Operations Analyst responsible for triaging security alerts, conducting initial investigations, and escalating potential incidents.

Europe Full-time Entry Level Security Analyst
DNS HTTP Linux macOS PowerShell Python SIEM TCP/IP
2 days, 6 hours ago
SIXGEN

Threat Hunter/Purple Team Operator

SIXGEN 51-250 Professional Services

SIXGEN is hiring a mid-level Threat Hunter / Purple Team Operator to hunt for threats, support red team engagements, and improve real-time defensive detection for government and critical-infrastructure customers.

United States Full-time Mid Level Security Analyst
Carbon Black Cybersecurity Elasticsearch PowerShell Python SIEM Splunk
4 days, 5 hours ago
PDI Technologies,

Manager, Threat Intelligence

PDI Technologies, 1K-5K Gas Utilities

PDI Technologies is seeking a Threat Intelligence, Threat Hunting, and Detection Engineering leader to build and lead a SOC program that protects more than 12,000 convenience retail, petroleum, hospitality, and automotive customers.

United States Full-time Lead Security Analyst
AWS Azure Cybersecurity Python SIEM Splunk
5 days, 6 hours ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers