Senior Threat Detection Engineer

Who you are

• We're looking for candidates with experience in Generative AI Security and who intimately understand MITRE ATLAS threat techniques and behaviors
• Experience in detection engineering, threat research, SOC operations, incident response, or related blue-team roles
• Understanding of core concepts across multiple domains
• Ability to write or validate detections using EQL, KQL, SQL, or similar query languages
• Familiarity with MITRE ATT&CK, MITRE ATLAS, and its application to mapping detection coverage
• Strong analytical and problem-solving skills, especially around false positives and weak-signal detection logic
• Clear, collaborative communication and willingness to learn from and partner with senior researchers
• Understanding of the Elastic Security Solution, Elastic’s prebuilt rules, Elastic query languages, or the Elastic Common Schema
• Experience with exposure validation, security control testing, or attack path validation platforms
• Ability to generate or script test telemetry using Python, Bash, PowerShell, or simple simulation tools
• Contributions to community detection content, blogs, OSINT research, or security rule repositories

What the job involves

• The Threat Research and Detection Engineering (TRaDE) team is responsible for developing and maintaining the prebuilt detection logic shipped with Elastic Security, researching emerging threats, validating detection efficacy, and engaging with the global community to democratize defensive capabilities
• We’re looking for a Security Research Engineer II with strong security fundamentals, hands-on detection engineering experience, and an interest in validating and improving defensive protections
• This role focuses on driving threat research and real telemetry into high-quality, reliable, high efficacy, detection content
• This position centers on practical detection development and validation work across multiple data sources and attack surfaces
• Responsibilities include writing and refining detection logic, validating rule behavior, and improving detection quality through telemetry analysis and testing
• Creating and refining detection logic across multiple domains (endpoint, cloud, identity, network, web, and email) domains using Elastic data sources
• Validating rule behavior through functional testing, false-positive review, and iterative tuning
• Evaluating attack paths across domains and contributing to coverage improvements throughout the kill chain
• Analyzing multi-source telemetry to uncover detection opportunities and strengthen signal-to-noise ratios
• Supporting cloud security validation efforts for AWS, Azure, or GCP detections
• Collaborating with senior researchers to test new detection approaches and incorporate emerging attacker techniques
• Using lightweight simulation tools or scripted tests to generate telemetry and validate detection behavior
• Participating in Elastic Security Labs efforts, detection package updates, documentation, or community knowledge sharing when appropriate!

Benefits

• Toast to your health: Fully paid health coverage for you and your family, in many locations.
• Craft your calendar: Flexible location and schedule for most roles.
• Create space for you: Distributed by design workforce, plus generous number of vacation days each year.
• Embrace parenthood: Minimum of 16 weeks of parental leave, plus generous family formation benefits.
• Give back your time: 40 hours each year to use toward volunteering with organizations and causes you’re passionate about.
• Amplify your impact: Double your charitable giving — we match donations up to $1500 USD (or local currency equivalent).