Threat Detection Engineer

Responsibilities

• Design and implement detection logic across SIEM/SOAR platforms including Splunk, Google SecOps, and Elastic.
• Build scalable detection rules and anomaly models aligned with the MITRE ATT&CK framework.
• Develop and maintain detection-as-code using Python and YAML-based formats like Sigma or YARA-L.
• Design LLM-assisted detection workflows, including prompt engineering for alert enrichment and classification.
• Build AI-augmented detection pipelines for anomaly scoring and natural language parsing.
• Identify and detect AI-specific risks such as prompt injection, model abuse, and data exfiltration.
• Collaborate with Threat Intelligence and Incident Response teams to translate TTPs into actionable detections.
• Participate in detection tuning, red/blue team exercises, and 24x7 on-call rotations.

Requirements

• 2-4 years of experience in security engineering or security operations.
• Proficiency with Splunk, Elastic Stack, or Google SecOps (Chronicle).
• Strong programming and scripting skills in Python and SQL.
• Experience authoring detection logic using YARA-L, Sigma, or equivalent formats.
• Hands-on experience with LLM APIs (e.g., OpenAI, Anthropic, Gemini) and AI/ML security use cases.
• Understanding of AI-specific threats including prompt injection and model inversion.
• Familiarity with MITRE ATT&CK, threat modeling, and Infrastructure-as-Code (Terraform, GitOps).

Preferred Qualifications

• Industry security certifications such as GCIA, GCIH, GCFA, or Security+.
• Experience with Google Cloud Platform (GCP) and Google Kubernetes Engine (GKE).
• Experience building SOAR integrations with LLM-assisted triage.
• Hands-on experience with agentic AI frameworks like LangChain or LlamaIndex.
• Familiarity with Snowflake's Security Data Lake or cloud-native log pipelines.

About the Company

ID.me is a next-generation digital identity wallet that simplifies how individuals securely prove their identity online. With over 152 million users, ID.me provides streamlined identity verification for federal agencies, state governments, healthcare organizations, and hundreds of consumer brands. We are committed to the mission of "No Identity Left Behind," ensuring everyone has access to a secure digital identity.