Note: The job is a remote job and is open to candidates in USA. LinkedIn is a professional network whose Information Security organization protects members, data, and platforms by building resilient security controls and detecting threats. The Senior Security Engineer will design, build, and operate high-signal detections across endpoint, identity, cloud, and SaaS environments while advancing detection engineering, telemetry quality, threat hunting, and incident response automation.
Responsibilities
- Implement and tune detection content across SIEM/XDR/EDR and cloud telemetry; measure precision/recall, latency, lift, and signal-to-noise ratio
- Build detections-as-code with version control, CI/CD, unit/integration tests, staged canary rollouts, and safe rollback
- Author and maintain SIGMA rules; translate SIGMA to KQL/SQL as needed
- Integrate multi-cloud telemetry: Azure (Activity/Diagnostics), AWS (CloudTrail, GuardDuty), GCP (Cloud Audit Logs, SCC)
- Operationalize Microsoft Defender XDR and Sentinel signals; leverage Entra ID controls (Conditional Access, sign-in risk)
- Proactive threat hunting; create hunt playbooks and convert findings into detections
- Build IR automation (SOAR/Logic Apps) for triage, enrichment, containment, and case workflow; integrate with ticketing/chat ops
- Operationalize threat intelligence: ingest/normalize IOCs/TTPs, enrich detections with TI context, and turn reports into testable hypotheses
- Own telemetry quality for assigned pipelines: schemas/normalization (e.g., ASIM/OCSF-like), enrichment, data contracts, reliability SLIs/SLOs
- Participate in incident retros; add post-incident detections and suppress noisy patterns
- Participate in on-call for critical detection pipelines and high-severity investigations
Skills
- BA/BS Degree in CyberSecurity, Information Security, Computer Science or related technical discipline, or related practical experience
- 3+ years in security, detection engineering or incident response
- Experience building detection content and analytics for SIEM/XDR/EDR and cloud telemetry (Azure/AWS/GCP)
- Experience programming for detections/automation (e.g., Python) and query languages (e.g., KQL/SQL/SPL)
- Experience with detections-as-code (tests, CI/CD, canary/rollback) at scale
- Experience with attacker TTPs (MITRE ATT&CK) and detection efficacy metrics
- Experience with schemas/data models (e.g., OSSEM/ASIM-like) and telemetry pipelines
- BS and 8+ years of relevant work experience, MS and 7+ years of relevant work experience, or PhD and 4+ years of relevant work experience
- Operating detections over large-scale, multi-region pipelines
- Detection testing harnesses, synthetic signal, and adversary emulation at scale
- Identity/security signals (Entra ID/Okta/SSO), endpoint internals (Windows/Linux/macOS), SaaS logs
- Applied analytics/ML for anomaly detection or risk scoring with robust evaluation
- Experience building hypotheses and content for AI-enabled attack patterns; practical use of AI to improve detection workflows
- Hands-on SIGMA authoring/translation; experience with adversary emulation/purple-team validation
- Experience with Microsoft Sentinel, Defender XDR, Entra ID; KQL, Python; GitHub Actions/Azure DevOps; Logic Apps; Azure Data Explorer/Kusto
- Experience with Azure Activity/Diagnostics; AWS CloudTrail/GuardDuty; GCP Cloud Audit Logs/SCC
Benefits
- Generous health and wellness programs for employees of all levels
- Time away for employees of all levels
- This role may be remote or hybrid
- Annual performance bonus
- Stock
- Benefits and/or other applicable incentive compensation plans
Company Overview
Company H1B Sponsorship