Cybersecurity Detection Engineer x2

Axiom Path•Charlotte, NC

2d•Hybrid

About The Position

Join a global financial services organization committed to maintaining resilient, secure, and highly regulated technology operations. The cybersecurity organization protects complex cloud and on-premises environments by strengthening monitoring, threat detection, and incident response capabilities. This position supports a collaborative Security Operations team that works closely with SOC analysts, incident responders, threat intelligence specialists, security engineers, and technology partners. The environment is fast-paced and analytical, with a strong emphasis on measurable detection coverage, automation, operational excellence, and continuous improvement. This hybrid position is based in Charlotte, North Carolina, and is W2 only; C2C and 1099 arrangements are not accepted. The role offers the opportunity to develop sophisticated threat detections across cloud and on-premises environments, work with security analytics, detection-as-code, automation, MITRE ATT&CK, and modern security monitoring technologies, and collaborate with global cybersecurity, threat intelligence, incident response, and technology teams. The engineer will directly improve the organization’s ability to identify and respond to emerging cyber threats.

Requirements

At least 3 years of experience in detection engineering, SOC engineering, security analytics, cybersecurity operations, or a related discipline.
Hands-on experience analyzing logs and telemetry from endpoint, network, identity, cloud, infrastructure, and application platforms.
Experience working with SIEM, UEBA, EDR, SOAR, security data lakes, or comparable security-monitoring technologies.
Strong knowledge of security query languages and data-analysis methods used to investigate events and build detection logic.
Experience developing automation, scripts, detection-as-code pipelines, or repeatable security operations processes.
Ability to convert threat intelligence, adversary behaviors, and attack techniques into practical detections.
Experience mapping detections or security coverage to MITRE ATT&CK or a similar framework.
Working knowledge of Windows, Linux, enterprise infrastructure, and cloud environments.
Strong troubleshooting, analytical, and root-cause analysis capabilities.
Ability to independently manage operational responsibilities and project deliverables.
Clear written and verbal communication skills, including the ability to document technical detection logic and tuning decisions.
Strong ownership, attention to detail, and the ability to collaborate effectively within a global team.

Nice To Haves

Experience in incident response, threat intelligence, vulnerability management, security engineering, or cloud security.

Responsibilities

Design, develop, test, tune, and maintain threat detection logic across cloud and on-premises environments.
Improve alert quality, monitoring visibility, and the organization’s ability to detect and respond to malicious activity.
Build and maintain log onboarding and data-ingestion processes for endpoint, network, identity, cloud, application, and infrastructure telemetry.
Translate threat intelligence, attacker behaviors, and indicators of compromise into actionable monitoring use cases.
Develop correlation rules, behavioral analytics, signatures, alert thresholds, and detection content that reduce false positives.
Partner with SOC analysts and incident responders to investigate alerts, validate detection effectiveness, and identify coverage gaps.
Map detection logic and security-monitoring coverage to the MITRE ATT&CK framework.
Apply scripting, automation, and detection-as-code practices to improve testing, deployment, scalability, and lifecycle management.
Evaluate security data sources, analytics capabilities, and monitoring technologies to identify opportunities for improvement.
Maintain documentation covering detection logic, data sources, tuning decisions, operational procedures, and response playbooks.
Ensure detection-engineering practices align with regulatory obligations, internal controls, and cybersecurity standards.
Assess the effectiveness of monitoring controls and recommend practical improvements that strengthen cyber resilience.