Walmart's Cybersecurity Threat Detection Team is expanding to further integrate threat intelligence with large-scale automated defenses. We are seeking a highly technical lead to help drive the next phase of our detection engineering strategy, building and enhancing the solutions that orchestrate the processing of vast amounts of telemetry across multiple markets, brands, and technology environments. This role will collaborate with established engineering teams to refine how we validate and deploy defensive logic, ensuring our protective measures keep pace with rapidly changing technology and threat landscapes. This senior technical position will build on existing foundations to automate the transformation of Threat Intelligence into detections at scale, primarily working with the SIEM Engineering, Detection Engineering, and UEBA functions. The scope encompasses all Walmart brands, international markets, and includes threat detection coverage for standard technology stacks, emerging technologies, and custom in-house applications. The ideal candidate should have a strong understanding of, or significant experience in, most of the following areas: Strategy & Operational Excellence Evaluating operational models, identifying areas for improvement, and recommending enhancements Leading the systematic auditing of detection solutions to identify dependencies, eliminate ineffective overlaps, and prioritize the closure of critical visibility gaps Establishing internal and external relationships to develop and maintain awareness of emerging threats and anti-detection mechanisms Establishing organizational threat protection strategies, balancing protection, capability, cost, and performance Threat Detection Defining the processes for the development, testing, and implementation of threat detections at scale across Azure, GCP, and on-premise production environments Leading the evaluation and adoption of emerging detection frameworks and platforms Scripting and Automation (preference for Python, Golang, Powershell) Query and Rule languages (SQL, KQL, SPL, Yara, Sigma) Utilizing TAXII and STIX to automate the ingestion and normalization of threat indicators into detection workflows. Data Analysis & Automation Processing and integrating data from a variety of sources to support timely and effective decision-making Knowledge of, or some experience with, the following: Automated ETL processes and data models integrated within CI/CD pipelines Leveraging Argo Workflows and Kubernetes to manage distributed data processing Architecting MCP servers to expose internal security telemetry and threat intelligence as tools and resources for SLM/LLM-powered agents and automation workflows Applying machine learning models to baseline user & entity behavior for the detection of sophisticated cyber attacks Incident Response & Documentation Incident management procedures for the detection, reporting, and handling of cyber incidents Writing comprehensive technical documentation Providing technical leadership during high-priority incidents
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
Job Type
Full-time
Career Level
Mid Level
Number of Employees
11-50 employees