Senior Detection Engineer

Morgan Stanley•Baltimore, MD

22h

About The Position

Morgan Stanley is seeking a Detection Engineer to join its Threat Hunt and Cyber Detection team within Cyber, Data, Risk and Resilience. This Cyber Security Engineering position is part of the job family responsible for specialist cyber expertise and solutions that protect the Firm’s systems and networks from actual and potential security threats and vulnerabilities. The role focuses on building and improving threat hunting, detection, and analysis capabilities to protect the Firm from evolving cyber threats. The position contributes to complex projects and initiatives, develops and maintains detection logic and threat-hunting content, and conducts proactive hunts and investigations. It also monitors vulnerabilities, third-party cyber events, and notable campaigns for potential impact; develops AI-assisted detection engineering capabilities; and builds bespoke tooling and automation. The engineer collaborates with security engineering, operations, incident response, intelligence, and architecture teams to strengthen security coverage and resilience.

Requirements

Experience in threat hunting, detection engineering, cyber threat intelligence, blue teaming, penetration testing, incident response, SOC operations, or related cybersecurity disciplines.
Experience analyzing security telemetry and applying adversary behaviors and threat intelligence to develop detections and investigations.
Proficiency in Python for security automation and tooling.
Experience developing or applying AI-assisted workflows, agents, or reusable skills to cybersecurity use cases.
Experience with detection engineering technologies such as Sigma, YARA, Elasticsearch, and Git.
Understanding of enterprise security architecture, network and endpoint telemetry, common attack techniques, and methods for detecting compromise across Windows and Linux environments.
Ability to process information, translate it into plans, and present summaries to stakeholders.
Experienced understanding of a business line and discipline.
At least 4 years of relevant experience would generally be expected to find the skills required for this role.

Responsibilities

Contribute to the function through complex project tasks and initiatives.
Develop and maintain detection logic and threat-hunting content based on adversary behavior, threat intelligence, and risk.
Conduct proactive threat hunts and investigate cases and alerts to identify suspicious activity and detection gaps.
Monitor critical vulnerabilities, third-party cyber events, and notable campaigns to assess potential impact to the Firm.
Develop AI-assisted detection engineering capabilities, such as reusable skills supporting triage, investigation, and detection development.
Build and enhance bespoke tooling and automation using Python, Sigma, YARA, Elasticsearch, and Git to improve the detection engineering lifecycle.
Collaborate with security engineering, operations, incident response, intelligence, and architecture teams to strengthen coverage and resilience.
Process information, translate it into plans, and present summaries to stakeholders.