Senior Engineer - Threat Detection Operations

Summary

Senior Engineer – Threat Detection OperationsWorking at Target means helping all families discover the joy of everyday life. We bring that vision to life through our values and culture. Target is an iconic brand, a Fortune 50 company and one of America's leading retailers. Behind the brand our guests love, is a culture of continual innovation – and right now, we are up to big things. The Cyber Fusion Center is the heart of Target's security team and a place where innovation happens daily. Join our team to take new enterprise security solutions from concept to release, collaborating with both software & security engineers to innovate on helping defend Target's network using cutting-edge technologies. We are looking for professional network engineers who will ensure Cybersecurity visibility requirements are being met through collaboration with Target's broader Network Engineering organization. You will also be working closely with Cybersecurity stakeholders to develop and continually improve our visibility posture so network-based threats can be detected.As a Senior Engineer – Threat Detection Operations, you will help advance Target's ability to detect and respond to sophisticated threats through the development of scalable, high-quality detections. This role focuses on transforming threat intelligence, incident learnings, and hunting outcomes into durable, high-fidelity detections. You will leverage large-scale security telemetry, analytics platforms, and automation frameworks to engineer detection content and improve security monitoring effectiveness. Working closely with Cyber Threat Intelligence, Incident Response, and security platform teams, you will turn actionable threat intelligence into high-confidence security signals to enable efficient detection and response.This role is ideal for someone who is highly technical, data-driven, and passionate about developing modern detection capabilities that keep pace with the evolving threat landscape.Core ResponsibilitiesDesign, develop, deploy, and maintain production-ready detections across a variety of security platforms, including SIEM, EDR, cloud, identity, and network security technologiesTranslate threat intelligence, incident response findings, and threat hunting outcomes into scalable, actionable detection logicDevelop and tune behavioral, signature-based, and statistical/anomaly-driven detections to identify malicious or suspicious activity while minimizing false positives and toilCollaborate with Cyber Threat Intelligence, Incident Response, Threat Hunting, and platform engineering teams to identify and resolve detection and visibility gapsValidate detection coverage against adversary tactics, techniques, and procedures (TTPs) using frameworks such as MITRE ATT&CKMeasure and report on detection performance, including fidelity, coverage, and effectivenessContribute to the continuous improvement of detection engineering practices, standards, and methodologiesAbout You4-year degree in cybersecurity, computer science, data science, or a related field, or equivalent practical experience.5+ years of experience in cybersecurity, including at least 3 years focused on developing detections informed by threat intelligence, adversary behaviors, and/or data science and machine learning techniques.Experience developing, deploying, and tuning detections across a variety of platforms such as SIEM, EDR, cloud security, and security analytics platformsExperience with cloud security monitoring across AWS, GCP, or Azure environmentsStrong understanding of end-to-end detection engineering concepts resulting in durable, scalable detection contentExperience scripting with languages such as Python, PowerShell, or Bash to automate security workflows and improve detection operationsStrong understanding of adversary tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK and the Cyber Kill ChainStrong analytical and problem-solving skills with the ability to evaluate security telemetry and identify detection opportunitiesStrong communication and collaboration skills with the ability to work effectively across security and engineering teamsAdditional Skills We Are Interested InExperience with detection-as-code methodologies, CI/CD pipelines, and automated testing frameworks for security contentExperience applying statistical analysis, anomaly detection, machine learning, or behavioral analytics to improve detection capabilitiesExperience with security data modeling, feature engineering, or graph-based threat detection techniquesExperience applying LLMs or AI-assisted workflows to detection development, alert triage, enrichment, or investigation use casesRelevant certifications such as GCIA, GCIH, GCED, GMLE, GCFA, or similar cybersecurity certifications

Job Description

Senior Engineer – Threat Detection OperationsWorking at Target means helping all families discover the joy of everyday life. We bring that vision to life through our values and culture. Target is an iconic brand, a Fortune 50 company and one of America's leading retailers. Behind the brand our guests love, is a culture of continual innovation – and right now, we are up to big things. The Cyber Fusion Center is the heart of Target's security team and a place where innovation happens daily. Join our team to take new enterprise security solutions from concept to release, collaborating with both software & security engineers to innovate on helping defend Target's network using cutting-edge technologies. We are looking for professional network engineers who will ensure Cybersecurity visibility requirements are being met through collaboration with Target's broader Network Engineering organization. You will also be working closely with Cybersecurity stakeholders to develop and continually improve our visibility posture so network-based threats can be detected.As a Senior Engineer – Threat Detection Operations, you will help advance Target's ability to detect and respond to sophisticated threats through the development of scalable, high-quality detections. This role focuses on transforming threat intelligence, incident learnings, and hunting outcomes into durable, high-fidelity detections. You will leverage large-scale security telemetry, analytics platforms, and automation frameworks to engineer detection content and improve security monitoring effectiveness. Working closely with Cyber Threat Intelligence, Incident Response, and security platform teams, you will turn actionable threat intelligence into high-confidence security signals to enable efficient detection and response.This role is ideal for someone who is highly technical, data-driven, and passionate about developing modern detection capabilities that keep pace with the evolving threat landscape.Core ResponsibilitiesDesign, develop, deploy, and maintain production-ready detections across a variety of security platforms, including SIEM, EDR, cloud, identity, and network security technologiesTranslate threat intelligence, incident response findings, and threat hunting outcomes into scalable, actionable detection logicDevelop and tune behavioral, signature-based, and statistical/anomaly-driven detections to identify malicious or suspicious activity while minimizing false positives and toilCollaborate with Cyber Threat Intelligence, Incident Response, Threat Hunting, and platform engineering teams to identify and resolve detection and visibility gapsValidate detection coverage against adversary tactics, techniques, and procedures (TTPs) using frameworks such as MITRE ATT&CKMeasure and report on detection performance, including fidelity, coverage, and effectivenessContribute to the continuous improvement of detection engineering practices, standards, and methodologiesAbout You4-year degree in cybersecurity, computer science, data science, or a related field, or equivalent practical experience.5+ years of experience in cybersecurity, including at least 3 years focused on developing detections informed by threat intelligence, adversary behaviors, and/or data science and machine learning techniques.Experience developing, deploying, and tuning detections across a variety of platforms such as SIEM, EDR, cloud security, and security analytics platformsExperience with cloud security monitoring across AWS, GCP, or Azure environmentsStrong understanding of end-to-end detection engineering concepts resulting in durable, scalable detection contentExperience scripting with languages such as Python, PowerShell, or Bash to automate security workflows and improve detection operationsStrong understanding of adversary tactics, techniques, and procedures (TTPs) and frameworks such as MITRE ATT&CK and the Cyber Kill ChainStrong analytical and problem-solving skills with the ability to evaluate security telemetry and identify detection opportunitiesStrong communication and collaboration skills with the ability to work effectively across security and engineering teamsAdditional Skills We Are Interested InExperience with detection-as-code methodologies, CI/CD pipelines, and automated testing frameworks for security contentExperience applying statistical analysis, anomaly detection, machine learning, or behavioral analytics to improve detection capabilitiesExperience with security data modeling, feature engineering, or graph-based threat detection techniquesExperience applying LLMs or AI-assisted workflows to detection development, alert triage, enrichment, or investigation use casesRelevant certifications such as GCIA, GCIH, GCED, GMLE, GCFA, or similar cybersecurity certifications