Threat Detection & Response Engineer III

Long Beach, CAfull timeOn Site

Apply on Employer Site

mid

$120k–$165k

H1B: no

Trueanomalyinc The Threat Detection & Response Engineer III at True Anomaly develops and matures detection capabilities and incident response processes to support security operations. The role includes designing detections, tuning rules, incident investigations, and optimizing security tooling.

Responsibilities

Develop incident response plans, playbooks, and SOPs; build scalable processes to support future team growth
Design and implement custom security detections across corporate and cloud environments, leveraging frameworks like MITRE ATT&CK
Continuously tune detection rules and develop threat models to improve fidelity and address coverage gaps
Monitor, triage, and respond to security alerts across multiple platforms and data sources
Perform incident investigations through technical analysis, containment, eradication, and recovery; document findings and lessons learned
Proactively hunt for threats and leverage threat intelligence to anticipate emerging adversary TTPs
Administer and optimize EDR and SIEM platforms; integrate log sources to enhance visibility and correlation
Build automation and orchestration workflows to improve response efficiency
Partner with cross-functional teams (IT, Engineering, Legal, Compliance) and communicate technical findings to diverse stakeholders

Qualification

A good candidate will have3+ years of experience in cybersecurityFamiliarity with EDR platformsWorking knowledge of WindowsExperience with scripting (PythonAn ideal candidate will also haveFamiliarity with CMMC

Required

A good candidate will have:
Active Secret/TS security clearance and ability to maintain a security clearance
3+ years of experience in cybersecurity, with at least 2 years focused on security operations, detection engineering, incident response, or threat hunting
Experience in building or tuning security detections
Familiarity with risk-based alerting and alert tuning, including strategies to reduce noise, improve detection fidelity, and prioritize high-signal alerts
Familiarity with EDR platforms, including basic alert triage and response actions
Working knowledge of Windows, MacOS, or Linux endpoint security and common attack techniques
Familiarity with SIEM platforms and log analysis (e.g., Splunk, Elastic, or similar)
Basic understanding of common attack vectors, TTPs, and security frameworks such as MITRE ATT&CK and the Cyber Kill Chain
Experience with scripting (Python, PowerShell, or Bash) for automation or analysis tasks
Clear verbal and written communication skills

Preferred

An ideal candidate will also have:
Knowledge of digital forensics and malware analysis techniques
Experience building or significantly maturing a detection and response program
Experience working in Azure Government Cloud (Azure GovCloud) environments
Experience with cloud security monitoring in AWS, GCP, or Azure commercial environments
Familiarity with CMMC, FedRAMP, NIST 800-53, or other federal compliance frameworks
Experience with Detections-as-Code paradigms, GitOps, CI/CD, etc
Experience participating in or supporting red team/purple team exercises