Senior Detection Engineer (AI-ML Focus)

Procter & Gamble•Cincinnati, OH

22h•$110,000 - $165,300•Onsite

About The Position

The Senior Detection Engineer plays a vital role in InfoSec's Cyber Defense Technology team, responsible for building, tuning, and scaling detection capabilities across enterprise SIEM platforms. This role operates at the intersection of detection engineering and AI — using agentic AI tooling and LLM-assisted workflows to accelerate threat detection development, validation, and coverage analysis. You will work within a threat-informed detection pipeline where intelligence drives what we detect, and AI agents assist in rule creation, validation, and optimization. The role is hands-on: writing detection logic, managing detection-as-code via git, collaborating with Threat Intelligence and Threat Hunting teams, and continuously improving alert fidelity.

Requirements

Bachelor’s degree in Information Systems, Information Technology (IT), Computer Science, Engineering, or other technical / IT field and / or at least 5+ years of relevant experience in detection engineering, security operations, or threat detection roles
Proven experience writing and tuning SIEM detection rules/analytics (correlation rules, scheduled queries, real-time alerts)
Strong understanding of MITRE ATT&CK framework and its application to detection coverage
Proficiency in Python for automation, scripting, and tooling
Experience with git-based workflows (branching, PRs, CI/CD) for managing security content
Familiarity with security log sources: EDR, identity, cloud, network, proxy
Strong analytical skills and ability to distinguish true threats from noise in large datasets

Nice To Haves

Certifications CISSP, CCSP, OSCP, GIAC Certified Detection Analyst (GCDA), GCIA, Relevant certifications in cloud & ML/AI
Experience with multiple query languages are helpful but not required
Experience with detection-as-code practices and YAML-based rule formats (Sigma, custom schemas)
Working knowledge of AI/LLM capabilities and their security implications — both as detection targets and as engineering tools
Experience with MCP servers, GitHub Copilot, or other AI-assisted development workflows
Familiarity with SOAR platforms and their integration with detection pipelines
Understanding of Kubernetes, cloud-native architectures, and OT/ICS environments

Responsibilities

Design, build, test, and tune detection rules mapped to MITRE ATT&CK, prioritized by threat intelligence and business risk
Write detection logic across the SIEM and data lake platforms
Manage detection content as code — Git-based workflows, PR reviews, CI/CD deployment pipelines
Investigate and suppress false positives systematically using lookup-based architectures
Collaborate with Threat Hunting and Threat Intelligence teams through structured handover processes (TI→TH→DE pipeline)
Monitor emerging threats and rapidly develop detections for new TTPs, CVEs, and active campaigns
Leverage AI agents and LLM-assisted workflows to accelerate detection rule development, validation, and coverage analysis
Use and contribute to MCP (Model Context Protocol) tooling that enables AI-assisted detection validation (e.g., querying telemetry, assessing LOLBAS/GTFOBins, checking coverage gaps)
Operate agentic pipelines that triage large rule libraries against live telemetry at scale
Apply AI/ML techniques where appropriate for anomaly detection, behavioral analytics, or pattern identification in security datasets
Stay current on frontier AI threats (agentic attacks, LLM-assisted exploitation, AI-generated phishing) and translate them into detection opportunities
Work closely with SOC analysts to understand alert quality feedback and drive fidelity improvements
Collaborate with data engineers on telemetry availability, data quality, and log source onboarding
Contribute to detection coverage reporting and MITRE ATT&CK posture measurement
Document detection logic, tuning rationale, and suppression decisions