Threat Detection Engineer (Cloud Security)

Dark Wolf is looking for a Threat Detection Engineer to design, build, test, and deploy detection logic using a "Detection-as-Code" methodology across on-premise and AWS GovCloud environments.

The role focuses on proactively engineering high-fidelity alerts, threat hunting against advanced adversary techniques, and automating response workflows to reduce alert fatigue.

Key Responsibilities:

• Design, build, test, and deploy robust detection logic using a "Detection-as-Code" methodology across on-prem and cloud-hosted AWS GovCloud environments
• Write and maintain custom detection signatures targeting cloud-native vectors, container security, and host-level behavior
• Ingest, normalize, and analyze AWS security logs (CloudTrail, VPC Flow Logs, GuardDuty, AWS Config, EKS Audit Logs) and on-prem telemetry into SIEM and data lake environments
• Proactively hunt for undetected malicious activity, insider threats, and novel adversary TTPs mapped against the MITRE ATT&CK Cloud Matrix
• Partner with NOSC operators and AWS Engineers to develop automated remediation and incident response playbooks within GitLab pipelines
• Conduct root-cause analysis on false positives/negatives to continuously improve alert fidelity, reduce noise, and optimize detection rules
• Utilize AI-assisted analysis and ML features to enhance query generation, automate threat intelligence correlation, and streamline detection development
• Participate in the development of DCO concept of operations, processes, and procedures
• Support vulnerability management mitigations, adhere to defined policies and schedules, and complete all required training and disclosures as outlined by BSTG.
• Participate in the development of DCO tactics, techniques, and procedures (TTPs), threat models, and supporting technical documentation.

Required Qualifications:

• 4+ years of relevant experience
• 2+ years of hands-on experience authoring and tuning detection logic in Splunk Enterprise and the ELK Stack (Elasticsearch, Logstash, Kibana).
• 2+ years of experience with employment of DoD cybersecurity requirements, policies, and procedures to include assessment and authorization activities.
• Experience within a vSOC, SOC, or CSSP responding to cyber incidents.
• Direct experience ingesting, normalizing, and engineering detections for AWS GovCloud security telemetry (CloudTrail, VPC Flow Logs, GuardDuty, EKS Audit Logs).
• Demonstrated experience using GitLab for Detection-as-Code, CI/CD pipelines, version control, and DevSecOps workflows.
• Department of Defense Directive (DoDD) 8140 (formerly DoDD 8570) IAT CSSP Certification must be obtained prior to hire (CEH, CCNA Security, GCIH, CySA+ or Equivalent).
• Bachelor’s degree in Computer Science, Information Technology, or a related field.
• US Citizenship and an active Top Secret/SCI security clearance required.

Desired Qualifications:

• Experience managing detections as code using Infrastructure as Code (IaC) tools like Terraform or CloudFormation.
• Familiarity with container runtime security (e.g., Falco, eBPF, Docker security) and Kubernetes threat modeling.
• Experience with RHEL
• Experience in performing post-incident computer forensics without destruction of critical data
• Ability to provide guidance on DoD Cyber regulations and requirements to engineering and software development staff

The salary range for this position is estimated to be between $100,000.00 - $160,000.00, commensurate on experience and technical skillset.