Threat Detection & Response Engineer III

True Anomaly•Long Beach, CA

6d•$115,000 - $165,000•Onsite

About The Position

As a Threat Detection & Response Engineer III at True Anomaly, you will help build and mature the organization’s threat detection and response capabilities, incident response processes, and security tooling. You will design and implement detections, strengthen incident response procedures, and contribute to the security program in a fast-paced environment where your work directly affects the company’s security posture. The position requires an active security clearance and is based onsite in either the Denver or Long Beach office. Participation in an on-call rotation, including after-hours coverage, is required.

Requirements

Active Secret or Top Secret security clearance and ability to maintain a security clearance.
At least 3 years of cybersecurity experience, including at least 2 years focused on security operations, detection engineering, incident response, or threat hunting.
Experience building or tuning security detections.
Familiarity with risk-based alerting and alert tuning, including reducing noise, improving detection fidelity, and prioritizing high-signal alerts.
Familiarity with EDR platforms, including basic alert triage and response actions.
Working knowledge of Windows, macOS, or Linux endpoint security and common attack techniques.
Familiarity with SIEM platforms and log analysis, such as Splunk, Elastic, or similar tools.
Basic understanding of common attack vectors, adversary tactics, techniques, and procedures, and security frameworks such as MITRE ATT&CK and the Cyber Kill Chain.
Experience scripting in Python, PowerShell, or Bash for automation or analysis.
Clear verbal and written communication skills.
Must be comfortable working under pressure during active security incidents.
Must be able to work onsite in the Denver or Long Beach office.
Must meet the stated U.S. Government space technology export-control eligibility requirements.

Nice To Haves

Knowledge of digital forensics and malware analysis techniques.
Experience building or significantly maturing a detection and response program.
Experience working in Azure Government Cloud (Azure GovCloud) environments.
Experience with cloud security monitoring in AWS, GCP, or Azure commercial environments.
Familiarity with CMMC, FedRAMP, NIST 800-53, or other federal compliance frameworks.
Experience with Detections-as-Code paradigms, GitOps, CI/CD, or similar practices.
Experience participating in or supporting red team or purple team exercises.

Responsibilities

Develop incident response plans, playbooks, and standard operating procedures, and build scalable processes for future team growth.
Design and implement custom security detections across corporate and cloud environments, using frameworks such as MITRE ATT&CK.
Tune detection rules and develop threat models to improve detection fidelity and address coverage gaps.
Monitor, triage, and respond to security alerts across multiple platforms and data sources.
Investigate incidents through technical analysis, containment, eradication, and recovery; document findings and lessons learned.
Proactively hunt for threats and use threat intelligence to anticipate emerging adversary tactics, techniques, and procedures.
Administer and optimize EDR and SIEM platforms, and integrate log sources to improve visibility and correlation.
Build automation and orchestration workflows to improve response efficiency.
Partner with IT, Engineering, Legal, Compliance, and other cross-functional teams, and communicate technical findings to diverse stakeholders.

Benefits

100% company-paid medical, dental, and vision coverage for the employee and dependents, with HSA/HRA options.
Flexible Time Off for exempt employees or accrued PTO of up to 25 days for non-exempt employees.
12 paid holidays.
Parental leave and sick leave.
Daily catered lunch and unlimited snacks for in-office employees.
401(k) retirement plan.
Fitness reimbursement.
Dog Fridays.
Equity participation as part of total compensation.
Professional development and certification support.