Threat Detection Engineer (Cloud Security)
Darkwolfsolutions · Ogden, UT
About this role
**Threat Detection Engineer (Cloud Security)** **Company:** Dark Wolf **Location:** Hill AFB, Ogden, Utah (On-site) **About the Role:** Design, build, test, and deploy detection logic using "Detection-as-Code" methodology across on-premise and AWS GovCloud environments. Focus on proactively engineering high-fidelity alerts, threat hunting against advanced adversary techniques, and automating response workflows. Leverage AI/ML capabilities to accelerate detection engineering and streamline incident response. **Key Responsibilities:** • Design and deploy robust detection logic across on-prem and AWS GovCloud environments • Write and maintain custom detection signatures for cloud-native vectors, container security, and host-level behavior • Ingest, normalize, and analyze AWS security logs (CloudTrail, VPC Flow Logs, GuardDuty, AWS Config, EKS Audit Logs) • Proactively hunt for undetected malicious activity and novel adversary TTPs (MITRE ATT&CK Cloud Matrix) • Develop automated remediation and incident response playbooks within GitLab pipelines • Conduct root-cause analysis on false positives/negatives to improve alert fidelity • Utilize AI-assisted analysis and ML features for threat intelligence correlation • Support vulnerability management and complete required training/disclosures **Required Qualifications:** • 4+ years of relevant experience • 2+ years hands-on experience with Splunk Enterprise and ELK Stack (Elasticsearch, Logstash, Kibana) • 2+ years with DoD cybersecurity requirements, policies, and assessment/authorization activities • Experience in vSOC, SOC, or CSSP responding to cyber incidents • Direct experience with AWS GovCloud security telemetry (CloudTrail, VPC Flow Logs, GuardDuty, EKS Audit Logs) • Demonstrated GitLab experience for Detection-as-Code, CI/CD pipelines, and DevSecOps • DoDD 8140 IAT CSSP Certification required prior to hire (CEH, CCNA Security, GCIH, CySA+ or equivalent) • Bachelor's degree in Computer Science, Information Technology, or related field • **US Citizenship and active Top Secret/SCI security clearance required** **Desired Qualifications:** • Infrastructure as Code (IaC) experience (Terraform, CloudFormation) • Container runtime security (Falco, eBPF, Docker security) and Kubernetes threat modeling • RHEL experience • Post-incident computer forensics experience • Ability to provide DoD Cyber regulations guidance **Compensation:** $100,000 - $160,000 (commensurate with experience) **Employment Type:** Direct, full-time W2 employees only EEO/AA Employer. US Citizenship verification and employment eligibility confirmation required.
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.