Security Engineer, Detection Engineering

Saronic Technologies is a leader in revolutionizing autonomy at sea, dedicated to developing state-of-the-art solutions that enhance maritime operations through autonomous and intelligent platforms.Security at Saronic is a force multiplier. We're seeking a Security Engineer at the senior-level or above on our Security Operations team with strong detection engineering experience. You'll design and develop high-fidelity detection content, build and operate the data pipelines that power our security operations, develop automation playbooks that accelerate response, and work across a uniquely diverse telemetry landscape spanning cloud infrastructure, embedded vessel platforms, corporate systems, and operational technology. This role is heavily weighted toward detection engineering. You should think in terms of adversary behavior and telemetry coverage, not just alert triage. You'll own detections end-to-end: from identifying gaps in coverage, through designing and testing detection logic, to tuning and validating in production.Key Responsibilities:Design, build, test, and tune high-fidelity detection rules and analytic queries across endpoint, cloud, network, identity, and DLP telemetry sourcesDevelop and maintain detection content using detection-as-code practices including version-controlled logic, automated testing, and CI/CD deploymentMap detection coverage to MITRE ATT&CK, identify gaps, and prioritize new detection development based on threat intelligence and business riskEngineer correlation rules, behavioral analytics, and anomaly-based detections that minimize false positives while surfacing real adversary tradecraftOwn the detection lifecycle from initial development through production tuning, performance monitoring, and retirementBuild and operate pipelines to ingest, normalize, enrich, and manage security telemetry at scale across diverse data sources, using Terraform and infrastructure-as-code practices to deploy and maintain logging and detection infrastructureDesign and maintain log collection, parsing, and enrichment configurations that ensure the right telemetry is available at the right fidelity for detection and investigationEvaluate and onboard new telemetry sources as Saronic's infrastructure and threat landscape evolveMonitor pipeline health, data quality, and ingestion reliability to ensure detections operate on complete and accurate dataDevelop and manage automated response playbooks in SOAR platforms to accelerate containment and reduce analyst toilBuild automation that enriches alerts with contextual data, reducing investigation time and improving analyst decision-makingSupport incident response efforts and translate lessons learned into improved detections and playbooksPartner with SOC analysts, Cloud Security, Product Security, and IT teams to close visibility and detection gaps across environmentsCollaborate with threat intelligence to ensure detection engineering is informed by current adversary TTPs relevant to defense, maritime, and autonomous systemsRequired Qualifications:3+ years of hands-on experience in detection engineering, security operations, security automation, or a closely related security engineering roleDemonstrated experience designing, testing, and tuning detection rules and analytic queries across production security telemetry (endpoint, cloud, network, identity, or DLP)Hands-on experience with SIEM platforms and proficiency with query languages such as SPL, KQL, or equivalentExperience building and operating security data pipelines, including log ingestion, normalization, enrichment, and data quality managementUnderstanding of data engineering concepts including ETL pipelines, data modeling, schema design, and indexing as applied to security telemetryHands-on coding experience in Python, PowerShell, Go, or Rust for security automation, detection tooling, or pipeline development, and familiarity with Terraform for managing detection and logging infrastructure as codeUnderstanding of MITRE ATT&CK framework and its application to detection coverage and gap analysisAbility to obtain and maintain a security clearancePreferred Qualifications:Experience in defense, aerospace, robotics, autonomy, or other high-assurance environmentsExperience with EDR platforms including custom detection rule creation and telemetry analysisExperience with cloud-native detection in AWS and Microsoft 365/AzureExperience using Terraform to deploy and manage security monitoring infrastructure, log pipeline components, or cloud-native security service configurationsHands-on experience with incident response, threat hunting, or adversary emulationExposure to embedded Linux, operational technology, or ICS telemetry and detectionFamiliarity with NIST SP 800-171, NIST SP 800-53, or CMMC and their logging and monitoring requirementsRelevant certifications such as GCIH, GCIA, GCDA, GSOM, OSDA, or OSCPBenefits:Medical Insurance: Comprehensive health insurance plans covering a range of servicesSaronic pays 100% of the premium for employees and 80% for dependentsDental and Vision Insurance: Coverage for routine dental check-ups, orthodontics, and vision careSaronic pays 100% of the premium under the basic plan for employees and 80% for dependentsTime Off: Generous PTO and HolidaysParental Leave: Paid maternity and paternity leave to support new parentsCompetitive Salary: Industry-standard salaries with opportunities for performance-based bonusesRetirement Plan: 401(k) planStock Options: Equity options to give employees a stake in the company’s successLife and Disability Insurance: Basic life insurance and short- and long-term disability coveragePet Insurance: Discounted pet insurance options including 24/7 Telehealth helplineAdditional Perks: Free lunch benefit and unlimited free drinks and snacks in the office If this role is based in the United States, it requires access to export-controlled information or items that require “U.S. Person” status. As defined by U.S. law, individuals who are any one of the following are considered to be a “U.S. Person”: (1) U.S. citizens, (2) legal permanent residents (a.k.a. green card holders), and (3) certain protected classes of asylees and refugees, as defined in 8 U.S.C. 1324b(a)(3).Saronic does not discriminate on the basis of race, sex, color, religion, age, national origin, marital status, disability, veteran status, genetic information, sexual orientation, gender identity or any other reason prohibited by law in provision of employment opportunities and benefits. We are also committed to providing