Depth in detection engineering: 10+ years in software, platform, or security engineering, including significant time building and operating detection or security capabilities at production scale.
Technical leadership as an individual contributor: Experience setting technical direction, leading complex multi-system initiatives, and raising the level of the engineers around you through design and code review, without managing people.
Software development expertise: Experience in a general-purpose programming language such as Python, Java, Kotlin, Scala, or JavaScript, used to build detection logic, tooling, and automation.
Detection platform ownership: Experience architecting a detections-as-code pipeline, detection platform, or production data pipeline that other engineers build on, rather than working within one someone else built.
AI-assisted engineering judgment: Experience applying generative AI, conversational AI, or AI agents to security engineering work, including cases where you concluded the AI-assisted approach was the wrong one.
Platform and cloud breadth: Experience with SIEM platforms such as Splunk, and with developing, securing, and monitoring applications in public cloud environments.
Other Qualifications
Production engineering discipline: Experience with automated testing, validation, and deployment for detection content, not only version control.
Threat-informed detection: Experience translating threat intelligence, adversary techniques such as those in MITRE ATT&CK, and incident learnings into durable detections, and verifying that those detections fire.
Adaptive detection analytics: Familiarity with behavioral baselines, entity-level context, anomaly detection, or risk-based alerting.
Cross-team technical leadership: Experience serving as the subject matter expert for partner teams, audits, and compliance or customer inquiries.
Program judgment: Proven ability to run several complex technical projects at once across competing priorities and ongoing operations.
Communication: Strong communication skills and the ability to present technical information to a non-technical audience.
Continuous learning: Enthusiasm for emerging work in security, data science, and machine learning, with the judgment to know what is worth adopting. Relevant certifications or training such as SANS or CISSP are useful but not required.