Principal Threat Detection Operations Engineer

Target • Brooklyn Park, MN

6d • $168,000 - $303,000

About The Position

As a Principal Engineer supporting Threat Detection Operations, you set technical strategy for the detection engineering, platforms, services, integrations, and automations that enable Target to detect cyber threats. You establish direction for how these capabilities are designed, developed, tested, deployed, and operationalized across multiple portfolios, and drive adoption across Target. You lead and approve engineering efforts to meet functional and non-functional requirements, including security, reliability, scalability, availability, performance, and maintainability.

The role combines principal-level engineering leadership with deep detection engineering expertise. It involves designing, developing, and continuously improving scalable detection capabilities that identify sophisticated threats across complex environments, while applying investigative judgment to ensure detections are actionable, resilient, and aligned to evolving adversary behaviors. You translate threat intelligence, incident learnings, and emerging attack techniques into durable detection strategies, engineering solutions, and process improvements. You serve as a thought leader and mentor for detection engineers and partner teams and contribute to the broader cybersecurity team and technology organization.

The position may be considered for a Remote or Hybrid (known internally at Target as “Flex for Your Day”) work arrangement based on Target’s needs. Remote team members work full-time from home or an alternate location that is not a Target location, do not have a desk at a Target location, and may travel to headquarters up to four times a year. Hybrid team members may work remotely or onsite at a Target location depending on the role, team, and tasks for the day. Work duties cannot be performed outside the country of the primary work location unless otherwise prescribed by Target.

Requirements

• Four-year degree or equivalent experience.
• Continuing education to maintain thorough knowledge of technical and cybersecurity domains and stay current with relevant technologies and threats.
• 10+ years of experience in cybersecurity engineering, detection engineering, threat hunting, security operations, security analytics, or related services, including independently designing, developing, validating, and improving detection capabilities in complex enterprise environments.
• Advanced Python programming and software engineering skills, including APIs, data structures, testing, code review, source control, packaging, error handling, and maintainable documentation.
• Demonstrated experience designing, developing, testing, deploying, and operating detection content and supporting services through modern CI/CD, detection-as-code, and DevSecOps practices, including automated testing, secure deployment, monitoring, rollback, versioning, and change governance.
• Strong hands-on experience with SIEM and security analytics platforms and production-grade detection rules, correlation logic, behavioral analytics, enrichment, and alerting workflows.
• Deep knowledge of detection engineering principles and ability to analyze endpoint, network, identity, cloud, application, and other security telemetry; understand adversary techniques and behaviors; identify detection opportunities and gaps; and develop high-fidelity, explainable, operationally sustainable detections.
• Strong understanding of secure systems design and operations, including authentication and authorization, secrets management, logging and telemetry, data handling, resilience, failure recovery, and reliable production operations.
• Demonstrated success solving complex technical problems across more than one technical or functional area.
• Understands business fundamentals and how technology can support business goals; can translate business and cyber risk into technical strategy and evaluate financial and operational implications.
• Proven leadership capabilities, influence, interpersonal skills, sound judgment, and calm decision-making in time-sensitive situations.
• Excellent verbal, written, and presentation skills to communicate complex technical and investigative findings clearly to technical teams, cybersecurity leaders, and business stakeholders.
• Strong team player with excellent planning and organizational skills and a demonstrated commitment to teamwork and team effectiveness.

Nice To Haves

• Familiarity with adjacent technologies such as EDR, SOAR, threat intelligence, identity, cloud security, network security, case management, and malware analysis.
• Experience with REST APIs, SQL/NoSQL data stores, Git, PowerShell or Bash, containers/Kubernetes, cloud technologies, and large-scale security data platforms.

Responsibilities

• Set and communicate the technical vision, architecture, and roadmap for detection engineering, aligning capabilities with Target’s cybersecurity priorities, business risks, threat landscape, and technical environments.
• Architect and lead development of scalable, reliable detection capabilities, services, integrations, and automations using Python, APIs, detection-as-code practices, event-driven patterns, and cloud-native technologies.
• Establish engineering standards for detection content, source control, peer review, automated testing, CI/CD, release management, observability, documentation, versioning, access controls, and resilient production operations.
• Lead the design, development, and lifecycle management of enterprise detection capabilities, including detection rules, behavioral analytics, correlation logic, detection pipelines, enrichment, alerting workflows, and analyst-facing tooling.
• Guide detection logic development, testing, tuning, validation, deployment, and continuous improvement to maximize effectiveness while reducing analyst workload.
• Partner with incident responders, threat hunters, threat intelligence, enterprise architecture, and technology teams to turn intelligence, adversary behaviors, investigative findings, and emerging risks into scalable detection capabilities.
• Assess detection technologies and technical solutions for viability, applicability, security, maintainability, and cost through proofs of concept, prototypes, architecture reviews, vendor evaluations, and build-versus-buy decisions.
• Define metrics and feedback loops for detection coverage, fidelity, precision, reliability, time to detect, alert quality, operational performance, and analyst expertise; use results to identify gaps and drive improvement.
• Influence telemetry and security data strategy by defining requirements for data quality, normalization, enrichment, retention, availability, and observability.
• Work with engineering and cybersecurity leaders to build a high-performing team; provide technical leadership and coaching, mentor engineers and analysts, and participate in selecting and developing technical talent.

Benefits

• Eligible team members and their dependents may receive comprehensive health benefits and programs, which may include medical, vision, dental, and life insurance.
• 401(k)
• Employee discount
• Short-term disability
• Long-term disability
• Paid sick leave
• Paid national holidays
• Paid vacation

What This Job Offers

• Job Type: Full-time
• Career Level: Principal