Detection Engineering Technical Leader

As a member of Cisco's Security organization in Detection Engineering, you design scalable detection content and pipelines to protect enterprise environments. You collaborate with Threat Hunting, SOC, and IR teams to close detection gaps and advance engineering threat detection solutions. You will shape the future of detection through automation, data science, and AI/ML-driven approaches, while mentoring peers and driving cross-functional initiatives. This role offers opportunities to influence security coverage across cloud and on-prem environments in a fast-paced, collaborative setting.

• Medical, dental and vision insurance
• 401(k) with company match
• Paid parental leave
• Paid time off (holidays, vacation, sick leave)
• RSU grants
• Volunteer time off

• Develop and maintain production-grade detection content and data models for security monitoring
• Build and optimize detection queries and workflows to handle high-volume telemetry
• Incorporate AI/ML techniques to improve detection quality and reduce false positives
• Translate threat intel and ATT&CK mappings into measurable detection coverage
• Collaborate with SOC, IR, threat intel, and product teams to drive end-to-end detection initiatives
• Mentor peers on detection standards and design patterns
• Contribute to cross-organizational projects to expand visibility and close detection gaps
• Review code and maintain robust, CI/CD-ready content pipelines

• Bachelor's degree with 8+ years, or Master's with 6+ years, or PhD with 3+ years in Security Engineering, Detection Engineering, Security Content Development, SOC, or Security Operations
• Experience deploying and maintaining security content in production SOC environments
• Proficient in building detection queries at scale with emphasis on risk-based alerting and efficient searches
• Experience integrating AI/ML techniques into detection pipelines to reduce false positives
• Ability to map threat intelligence and ATT&CK techniques to detection requirements with clear metrics

• Collaborative mindset
• Mentoring and code-review skills
• Strong written and verbal communication
• Security content development in a SIEM environment
• SPL or equivalent query languages
• AI/ML techniques for anomaly detection and thresholding