Senior Threat Detection Engineer - Intelligence

Miro•Austin, TX

About The Position

We’re looking for a Senior Threat Detection & Intelligence Engineer to help us understand how adversaries operate, detect meaningful threats early, and lead investigations when it matters most. This role sits at the intersection of threat intelligence, detection engineering, and incident investigation with an engineering-first mindset. If you enjoy turning messy signals into clear attacker narratives, this role is for you. About the Team The Cloud Security & Detection & Response (CSDR) team protects Miro by staying ahead of credible threats. We focus on: Translating external threat intelligence into actionable detections Building custom, high-fidelity detections for cloud and SaaS environments Leading complex investigations and incident response Partnering with engineering to drive security by design We care about context, signal quality, and attacker intent not alert volume.

Requirements

5–7 years in security , with 2+ years in threat detection, threat intelligence, or investigations
Experience in cloud-native SaaS environments (AWS strongly preferred)
Strong investigation skills and ability to analyze attacker behavior
Experience using threat intelligence to inform detection and response
Proficiency in Python and comfort automating security workflows
Experience querying large datasets (SQL or similar)
Familiarity with cloud security telemetry, logging, and detection platforms
Solid understanding of incident response and digital forensics
Experience with Infrastructure as Code (Terraform or similar)

Nice To Haves

Think in attacker TTPs, not just alerts or dashboards
Enjoy investigating ambiguous signals and turning them into clear conclusions
Have experience in threat intelligence, threat hunting, or security investigations
Care about why something is happening, not just what fired
Want to build detection programs that evolve with the threat landscape
Are comfortable explaining technical risk in business terms

Responsibilities

Track emerging threats, attacker techniques, and campaigns relevant to cloud and SaaS
Turn threat intelligence into practical detection strategies and attack hypotheses
Design and maintain context-aware detections across cloud, identity, and application layers
Lead deep investigations, from first signal to root cause and remediation
Act as a technical lead during security incidents, guiding response and decision-making
Analyze detection and investigation trends to improve preventative controls
Partner with engineering teams to raise security maturity across the organization