# Detection Engineer

**Company**: Cisco
**Location**: Denver, Colorado
**Work arrangement**: hybrid
**Experience**: senior
**Job type**: full-time
**Salary**: $150,500.00 to $190,800.00
**Category**: Engineering
**Industry**: Technology

**Apply**: https://cisco.wd5.myworkdayjobs.com/en-US/Cisco_Careers/job/Denver-Colorado-US/Detection-Engineering-Technical-Leader_2022041-1?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_336a5bdd-136

## Description

This role works within Splunk’s internal security organization as a member of the Detection Engineering team responsible for securing the Splunk portfolio.

You will partner fluidly with our multi-functional peer teams: Threat Hunting & Intelligence, SOC, Advanced Response, and others, to ensure that Splunk is always prepared for emergent threats.

As a Detection Engineer, you will design and build data processing pipelines that efficiently transform high-volume security telemetry into actionable alert signals for downstream agentic and human triage.

You will also drive complex, cross-organizational initiatives with business partners to continuously expand visibility and close detection gaps.

The successful applicant will be performing work in FedRAMP High or IL-5 environments, and therefore, must be a U.S. Person (i.e. U.S. citizen, U.S. national, lawful permanent resident, asylee, or refugee).

**Minimum Qualifications:**

- Bachelor’s + 8 years of related experience or a Master’s degree with 6+ years of related experience, or a PhD + 3 years of related experience as a Security Engineer, Detection Engineer, Security Content Developer, SOC Analyst, or Security Operations professional

- Deployed and maintained Splunk Enterprise Security content in a production SOC environment, including detections, data models, and data management

- Built detection queries in SPL at scale, including risk-based alerting, statistical baselining, and optimized searches across high-volume data sources

- Integrated AI/ML techniques (e.g., anomaly detection, LLM-assisted workflows) into detection engineering pipelines to reduce false positive rates and accelerate content development

- Translated threat intelligence and ATT&CK-mapped adversary behaviors into detection requirements with defined coverage metrics and measurable success criteria

**Preferred Qualifications:**

- Contributed to collaborative development workflows using Git-based platforms (GitHub, GitLab, or Bitbucket), including branch strategy, code review, and CI/CD integration

- Built or tuned security monitoring coverage across AWS, GCP, or Azure, including native logging services (e.g., CloudTrail, GCS audit logs, Azure Monitor) and cloud-native threat detection

- Tracked and responded to emerging threats and attacker techniques through ongoing research, published work, conference participation, or contributions to detection content

- Wrote production Python (or equivalent) with unit tests, code reviews, and version-controlled deployments in an operational security environment

- Applied statistical methods or ML techniques (e.g., threshold baselining, clustering, anomaly scoring) to security data to improve detection signal quality

- Identified and delivered automation that measurably reduced manual toil or cycle time in detection, triage, or response workflows

- Produced technical documentation, runbooks, or presentations tailored to both engineering and non-technical security stakeholders

- Partnered with SOC, IR, threat intel, and product teams to drive multi-functional detection initiatives from requirement to deployment

**Benefits:**

- Medical, dental and vision insurance

- 401(k) plan with a Cisco matching contribution

- Paid parental leave

- Short and long-term disability coverage

- Basic life insurance

- 10 paid holidays per full calendar year, plus 1 floating holiday for non-exempt employees

- 1 paid day off for employee’s birthday, paid year-end holiday shutdown, and 4 paid days off for personal wellness

- Non-exempt employees receive 16 days of paid vacation time per full calendar year

- Exempt employees participate in Cisco’s flexible vacation time off program

- 80 hours of sick time off provided on hire date and each January 1st thereafter

- Optional 10 paid days per full calendar year to volunteer

## Skills

### Required
- Splunk Enterprise Security
- SPL
- AI/ML
- Threat Intelligence
- ATT&CK

### Nice to have
- Python
- Git
- AWS
- GCP
- Azure
- Statistical Methods
- ML Techniques

---

Source: [Apply at cisco.wd5.myworkdayjobs.com](https://cisco.wd5.myworkdayjobs.com/en-US/Cisco_Careers/job/Denver-Colorado-US/Detection-Engineering-Technical-Leader_2022041-1?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)