ThreatLocker
Detection Engineer
Orlando, FLmidAdded today
About this role
ThreatLocker seeks a Detection Engineer to develop and maintain detection rules for their EDR and ITDR platforms in Orlando, FL. You'll create Sigma, YARA, and Snort rules aligned with MITRE ATT&CK while analyzing telemetry and collaborating with threat researchers to identify and close detection gaps.
What you'll do
- Develop, test, and maintain detection content for EDR and ITDR platforms
- Create and tune custom Sigma, YARA, and Snort detection rules to minimize false positives
- Map detections to MITRE ATT&CK Framework and improve coverage gaps
- Analyze Windows telemetry and forensic artifacts to identify detection opportunities
- Research attacker techniques including persistence, privilege escalation, and defense evasion
- Validate detection logic through threat hunting, malware analysis, and adversary emulation
What they're looking for
- Sigma, YARA, and Snort rule development
- MITRE ATT&CK Framework knowledge
- Windows operating systems and forensic artifacts
- EDR/ITDR platform experience
- Malware analysis and threat hunting
- Adversary emulation and post-exploitation frameworks
- Windows persistence and privilege escalation techniques
- Critical thinking and troubleshooting
Benefits
- In-office position in Orlando, FL
Opens the official application on the employer’s site. No login required.
ThreatLocker
ThreatLocker builds endpoint protection and cybersecurity platform solutions designed to secure and manage critical systems. The company is hiring Windows developers, database engineers, IT specialists, and solutions engineers to support product development, infrastructure, and customer success.
- Website
- threatlocker.com
Likely interview questions
- Describe your experience developing detection rules—what rule types have you created and for which platforms?
- Walk us through how you've used MITRE ATT&CK to identify and close detection gaps in a previous role.