Senior Detection Engineer

REI (Recreational Equipment Inc.)•Seattle, WA

16h

About The Position

REI Co-op is seeking a Senior Detection Engineer to help protect its people, members, and systems as part of the Security Operations team. The role builds ways to detect and stop cyber threats across devices, user access, networks, cloud tools, software services, and emerging AI tools. The engineer writes and tunes alerts, hunts for threats, reviews security events, and uses scripting and automation to make incident response faster, more efficient, and repeatable. The role works with security analysts, engineers, data teams, and business partners to close security gaps, improve data, and support sound decisions during events. Participation in the on-call schedule is required as needed.

Requirements

Bachelor’s degree in computer science, information security, information technology, or a related field; an equal mix of education and work experience also meets this requirement.
At least 5 years of work in security operations, detection engineering, threat hunting, incident response, or security engineering.
Experience creating and tuning alerts in a SIEM such as Splunk or Microsoft Sentinel.
Experience with EDR tools such as Microsoft Defender, CrowdStrike, or SentinelOne.
Ability to review threats across devices, user access, networks, cloud tools, or SaaS services, including log review and root-cause analysis.
Working knowledge of MITRE ATT&CK and attacker tactics, techniques, and procedures.
Skill in at least one scripting language, such as Python or PowerShell.
Ability to work well with technical and business teams.

Responsibilities

Build, test, and maintain threat alerts using SIEM, EDR, cloud, network, SaaS, and application tools, including Microsoft Sentinel, Splunk, or similar tools.
Use MITRE ATT&CK, threat data, and event trends to identify gaps, reduce false alerts, and improve alert quality.
Participate in threat hunts and security event reviews; help contain threats, identify root causes, and restore service.
Turn lessons from events into new alerts and guides.
Build scripts, workflows, reports, and SOAR integrations to make alert review and event response faster, clearer, and repeatable.
Build monitoring for AI applications, copilots, agents, and AI data use to help detect data loss, stolen access, unsafe prompts, and misuse.
Work with security, engineering, data, and business teams and share clear updates.
Take part in the on-call schedule as needed.