Senior Threat Detection & Response Engineer
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Senior threat detection engineer building AI/ML pipelines and detection-as-code workflows. Automating response and strengthening cybersecurity for Allstate’s insurance business.
Responsibilities:
- Define, design, and build AI/ML pipelines for investigation, triage, enrichment, and detection generation
- Own delivery of AI-assisted investigation and triage from data foundations and feature/enrichment pipelines through model selection, evaluation, and safe production deployment
- Set standards for validating, explaining, and trusting AI/ML outputs in detection and response workflows
- Design and own the detection-as-code pipeline, including repository structure, detection schema, peer review, automated testing, and staged CI/CD deployment across SIEM, XDR, and endpoint detection surfaces
- Define technical standards, reusable patterns, and quality controls for detection content
- Build tooling and APIs for authoring, testing, and debugging detections
- Design AI-driven automation and SOAR-style workflows for phishing, DLP, enrichment, routing, and verified-benign report closure
- Build response automation, playbooks, containment actions, and integrations to reduce dwell time and mean time to respond
- Establish and maintain a MITRE ATT&CK coverage baseline
- Partner with Threat Intelligence and Threat Hunting to convert findings into durable, tested detections
- Establish continuous validation through breach-and-attack simulation and purple-team activities
- Lead technical projects end-to-end, including scoping, execution, delivery accountability, and outcome ownership
- Serve as the senior-most individual-contributor technical authority and final technical escalation point for detection engineering
- Influence roadmap and tooling decisions with internal platform partners and help shape a global follow-the-sun operating model
Requirements:
- Hands-on experience designing and building AI/ML pipelines for security data, including data and enrichment foundations, model evaluation, production deployment, and guardrails
- Experience writing, versioning, testing, and shipping detections as code
- Deep hands-on detection engineering experience across SIEM and EDR/XDR platforms
- Fluency in KQL, SQL, Sigma, or equivalent
- Strong scripting/development skills, such as Python or Go
- Experience mapping detections to MITRE ATT&CK and partnering with threat hunting and threat intelligence
- Experience leading technical projects to completion and owning delivery outcomes
- Ability to explain detection strategies, AI/ML design choices, and engineering trade-offs to engineers and senior leaders
- Background investigation required
- Allstate generally does not sponsor individuals for employment-based visas for this position
- Dedicated, private workspace free from distractions when working from home
- Reliable internet with minimum speeds of 50 MB download and 5 MB upload
- Nice to have: AI-assisted/agentic SOC experience; security data engineering or streaming pipeline experience; enterprise SIEM, XDR, and EDR experience; purple-team, adversary-emulation, or breach-and-attack-simulation experience; financial services, insurance, or regulated, high-scale environment exposure
Benefits:
- Comprehensive technology setup, including a laptop, monitors, headset, keyboard, and mouse
- Monthly connectivity reimbursement for employees eligible to work from home
Similar Jobs
Quantum Computing, Cryptography Engineer
Quantum cryptography engineer advancing federal cybersecurity and post-quantum readiness at MKS2 Technologies. Evaluating quantum risks and leading enterprise cryptographic modernization strategies.
AWS Virtual Workplace Engineer
AWS Virtual Workplace Engineer designing and operating high-performance virtual desktops for ELITS Canada’s enterprise customers. Supporting engineering workloads, AWS integrations, troubleshooting, monitoring, and technical documentation.
Senior/Principal JavaScript Engineer
Principal JavaScript Engineer architecting scalable AI-first software for CoderPush’s startup and global-business clients. Leading technical direction, full-stack delivery, engineering standards, and mentorship.
Forward Deployed Engineer – SSE
Cisco Forward Deployed Engineer guiding strategic enterprise customers’ Security Service Edge deployments. Bridging customer escalations, product engineering, and global zero-trust security rollouts.
Fleet Chief Engineer
Fleet Chief Engineer overseeing Leidos maritime vessel engineering, maintenance, compliance, and readiness. Leading engineering personnel and standardizing Vessel Management System, maintenance, and safety practices across programs.
Software Installation Engineer
Software Installation Engineer deploying and upgrading Varian medical software in customer environments. Troubleshooting systems, networking, and virtualization while supporting healthcare projects across ASEAN and Korea.
Renewable Development Engineer
Renewable Development Engineer designing preliminary PV, BESS, and wind projects for NEI Electric Power Engineering. Supporting proposals, electrical studies, pricing, and client relationships.
Lift Engineer
Lift Engineer servicing, repairing, and fault-finding lifts across Portsmouth for Stannah, a global access-equipment manufacturer. Maintaining safe, compliant operation across commercial, residential, and public sites.
Lift Engineer
Lift Engineer servicing, repairing, and maintaining lifts across Guildford for Stannah, a UK access and mobility manufacturer. Managing a structured local route and allocated customer-site patch.
Lift Repair Engineer
Lift Repair Engineer repairing, diagnosing, and restoring lifts across East Anglia. Maintaining reliable service for Stannah’s residential, commercial, and public-site customers.
Lift Repair Engineer
Lift Repair Engineer repairing and fault-finding lifts across Chichester for Stannah, a global access-engineering manufacturer. Diagnosing mechanical and electrical issues and restoring equipment safely.
Lift Engineer
Lift Engineer servicing and repairing Stannah lifts across Cambridge and surrounding areas. Maintaining safe, compliant operation across commercial, residential, and public sites.
Lift Repair Engineer
Lift Repair Engineer repairing and maintaining lifts across Salisbury and surrounding areas. Stannah manufactures lifts, stairlifts, escalators, and homelifts and provides maintenance services.
Global Resolution Engineer – Networking SME
Global Resolution Engineer specializing in networking for WEKA’s AI-native data infrastructure. Escalating customer issues across HPC, AI/ML, cloud, and enterprise deployments.
Kafka and Streaming Engineer
Kafka and streaming engineer modernizing client integration solutions. Developing Java, Flink, Kafka Connect, and Confluent applications across the SDLC.
Network Planning Engineer
Network Planning Engineer supporting Capgemini’s engineering services through Carrier Ethernet capacity, lifecycle, migration, and decommission planning. Maintaining network audits, infrastructure readiness, databases, and governance reporting.
Telephony Engineer
Telephony Engineer owning SIP integrations and enterprise support for Retell AI’s AI-powered contact center platform. Debugging call quality and reliability across major CPaaS and CCaaS systems.
Forward Deployed Engineer – Clearance Required
Forward Deployed Engineer integrating LMI’s LIGER GenAI platform for federal customers. Building tailored features, deployments, and proof-of-concept solutions with up to 50% travel.
Logistics Engineer Intern, Summer 2027
Logistics Engineer Intern supporting warehouse solution design and AI-driven process improvements at Iron Mountain. Analyzing logistics data, facility layouts, and material flow to improve productivity.
Senior Project Engineer, SDS
Senior Project Engineer deploying Fujifilm Synapse healthcare imaging solutions. Designing infrastructure, integrations, migrations, and disaster recovery for hospitals and clinical systems.