# Threat Detection Engineer (Cloud Security)

**Company**: Dark Wolf
**Location**: Ogden, UT
**Work arrangement**: onsite
**Experience**: senior
**Job type**: full-time
**Salary**: $100,000.00 - $160,000.00
**Category**: Security
**Industry**: Technology

**Apply**: https://job-boards.greenhouse.io/darkwolfsolutions/jobs/7981898003?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_c3334fa8-441

## Description

Dark Wolf is looking for a Threat Detection Engineer to design, build, test, and deploy detection logic using a "Detection-as-Code" methodology across on-premise and AWS GovCloud environments.

The role focuses on proactively engineering high-fidelity alerts, threat hunting against advanced adversary techniques, and automating response workflows to reduce alert fatigue.

Key Responsibilities:

- Design, build, test, and deploy robust detection logic using a "Detection-as-Code" methodology across on-prem and cloud-hosted AWS GovCloud environments

- Write and maintain custom detection signatures targeting cloud-native vectors, container security, and host-level behavior

- Ingest, normalize, and analyze AWS security logs (CloudTrail, VPC Flow Logs, GuardDuty, AWS Config, EKS Audit Logs) and on-prem telemetry into SIEM and data lake environments

- Proactively hunt for undetected malicious activity, insider threats, and novel adversary TTPs mapped against the MITRE ATT&CK Cloud Matrix

- Partner with NOSC operators and AWS Engineers to develop automated remediation and incident response playbooks within GitLab pipelines

- Conduct root-cause analysis on false positives/negatives to continuously improve alert fidelity, reduce noise, and optimize detection rules

- Utilize AI-assisted analysis and ML features to enhance query generation, automate threat intelligence correlation, and streamline detection development

- Participate in the development of DCO concept of operations, processes, and procedures

- Support vulnerability management mitigations, adhere to defined policies and schedules, and complete all required training and disclosures as outlined by BSTG.

- Participate in the development of DCO tactics, techniques, and procedures (TTPs), threat models, and supporting technical documentation.

Required Qualifications:

- 4+ years of relevant experience

- 2+ years of hands-on experience authoring and tuning detection logic in Splunk Enterprise and the ELK Stack (Elasticsearch, Logstash, Kibana).

- 2+ years of experience with employment of DoD cybersecurity requirements, policies, and procedures to include assessment and authorization activities.

- Experience within a vSOC, SOC, or CSSP responding to cyber incidents.

- Direct experience ingesting, normalizing, and engineering detections for AWS GovCloud security telemetry (CloudTrail, VPC Flow Logs, GuardDuty, EKS Audit Logs).

- Demonstrated experience using GitLab for Detection-as-Code, CI/CD pipelines, version control, and DevSecOps workflows.

- Department of Defense Directive (DoDD) 8140 (formerly DoDD 8570) IAT CSSP Certification must be obtained prior to hire (CEH, CCNA Security, GCIH, CySA+ or Equivalent).

- Bachelor’s degree in Computer Science, Information Technology, or a related field.

- US Citizenship and an active Top Secret/SCI security clearance required.

Desired Qualifications:

- Experience managing detections as code using Infrastructure as Code (IaC) tools like Terraform or CloudFormation.

- Familiarity with container runtime security (e.g., Falco, eBPF, Docker security) and Kubernetes threat modeling.

- Experience with RHEL

- Experience in performing post-incident computer forensics without destruction of critical data

- Ability to provide guidance on DoD Cyber regulations and requirements to engineering and software development staff

The salary range for this position is estimated to be between $100,000.00 - $160,000.00, commensurate on experience and technical skillset.

## Skills

### Required
- Splunk Enterprise
- ELK Stack
- GitLab
- AWS GovCloud
- CloudTrail
- VPC Flow Logs
- GuardDuty
- EKS Audit Logs
- SIEM
- MITRE ATT&CK Cloud Matrix
- Artificial Intelligence
- Machine Learning

### Nice to have
- Terraform
- CloudFormation
- Falco
- eBPF
- Docker security
- Kubernetes threat modeling
- RHEL

---

Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/darkwolfsolutions/jobs/7981898003?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)