Cyber Detection & Automation Engineer

Codetech•Seattle, WA

About The Position

The Cyber Detection & Automation Engineer designs, develops, and maintains advanced threat-detection logic and workflow automations across security tools and platforms. The role works closely with SOC analysts, threat intelligence, and incident response commanders to support proactive and accurate detection of malicious activity. The cybersecurity team helps secure global operations, protect trusted information, assess cybersecurity and compliance risks, and maintain employee awareness of security and compliance topics. The engineer creates and tunes detections using SIEM, EDR, and other telemetry sources, and builds SOAR workflows and integrations—primarily using Microsoft Sentinel and Logic Apps. The position also improves SOC visibility and efficiency through automation, dashboards, documentation, and ongoing assessment of detection coverage and accuracy. It collaborates across security operations and threat intelligence and communicates findings and improvements to senior management.

Requirements

Bachelor's degree in cybersecurity, computer science, information technology, or a related field.
5+ years of cybersecurity experience, including 3+ years specifically in detection and automation engineering.
Proficiency writing detection logic using KQL, SPL, or other relevant query languages.
Experience with query languages such as KQL and SPL and scripting languages such as Bash, PowerShell, Python, or JavaScript.
Proficiency developing automations using SOAR platforms, specifically Microsoft Sentinel and Logic Apps.
Understanding of SOC operations, incident-response workflows, and threat-detection techniques.
Experience with RESTful APIs and third-party tool integrations.
Experience building advanced analytics (ML) and developing AI agents or tools.
Experience in a cloud-first or hybrid cloud environment; AWS and Azure are preferred.
Practical knowledge of the MITRE ATT&CK framework and mapping adversary behaviors to telemetry for detection design.
Deep understanding of attacker TTPs, threat modeling, and detection methodologies.
Familiarity with version control (Git), CI/CD pipelines, and infrastructure-as-code concepts.
Experience using security orchestration, automation, and response tools.
Strong analytical skills, including analyzing large volumes of data to identify potential threats and patterns.
Ability to communicate effectively, verbally and in writing, with audiences of different technical skill levels.
Ability to collaborate cross-functionally in a fast-paced retail business environment.
Required skill: Network Security.
Demonstrates personal responsibility, an entrepreneurial and innovative spirit, honest and kind communication, courage, relationship-building, and a capacity to bring fun and joy to work.

Nice To Haves

Relevant certifications such as Microsoft SC-200, Azure Security Engineer Associate, AWS Certified Security – Specialty, GIAC (GCIA, GCTI, GDAT), CISSP, or CISM.

Responsibilities

Design, implement, and automate high-fidelity detection rules using SIEM, EDR, and other telemetry sources such as Sentinel, Defender, and AWS.
Monitor and tune alerts to reduce false positives and improve the signal-to-noise ratio.
Test and validate detection content for effectiveness and accuracy.
Document detections and engineering processes, and create knowledge-transfer materials.
Perform gap analysis and continuously improve detection coverage, accuracy, and resilience.
Design and develop security automation workflows using SOAR platforms, primarily Microsoft Sentinel and Logic Apps.
Build and maintain custom integrations with SIEM, EDR, threat-intelligence feeds, ticketing systems, and other SOC tools.
Automate repetitive SOC tasks, including alert triage, enrichment, IOC lookups, and ticket creation.
Develop dashboards or utilities that improve visibility into SOC metrics and operational insights.
Collaborate with SOC analysts and threat intelligence to address evolving adversary tactics using the MITRE ATT&CK framework.
Create and update runbooks, playbooks, and documentation about detection rules and attacker TTPs.
Prepare and present detailed reports on detection and automation activities, findings, and improvements to senior management.