Principal Threat Detection Operations Engineer

Target

. Set and communicate the technical vision, architecture, and roadmap for detection engineering .

Posted 11/2/2026full-timeBrooklyn Park • Minnesota • United StatesLead💰 $168,000 - $303,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in detection engineering, including the design and development of detection capabilities, behavioral analytics, and correlation logic across various environments. Proven ability to lead technical teams, establish engineering standards, and translate cyber risks into effective detection strategies.

Highest-signal resume keywords

Detection EngineeringAdvanced Python ProgrammingCI/CD PracticesSIEM PlatformsTechnical Leadership

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Detection Rules DevelopmentBehavioral AnalyticsCorrelation LogicAutomated TestingSecure DeploymentREST APIsSQL/NoSQL Data StoresGitPowerShellCloud Technologies

Soft Skills

LeadershipInterpersonal SkillsDecision-MakingPlanningTeamwork

Tools & Technologies

SIEMEDRSOARKubernetesSecurity Analytics Platforms

Industry Keywords

Cybersecurity EngineeringThreat HuntingSecurity OperationsSecurity AnalyticsDetection-as-Code

Tech Stack

Tools & technologies

CloudCyber SecurityKubernetesNoSQLPythonSQL

About the role

Key responsibilities & impact

Set and communicate the technical vision, architecture, and roadmap for detection engineering
Architect and lead scalable detection capabilities, services, integrations, and automations across enterprise, cloud, identity, endpoint, network, and application environments
Establish engineering standards for detection content, source control, peer review, automated testing, CI/CD, release management, observability, documentation, versioning, access controls, and resilient production operations
Lead the design, development, and lifecycle management of detection rules, behavioral analytics, correlation logic, detection pipelines, enrichment, alerting workflows, and analyst-facing tooling
Guide detection logic development, testing, tuning, validation, deployment, and continuous improvement
Partner with incident responders, threat hunters, threat intelligence, enterprise architecture, and technology teams to translate intelligence and emerging risks into detection capabilities
Evaluate detection technologies through proofs of concept, prototypes, architecture reviews, vendor evaluations, and build-versus-buy decisions
Define metrics and feedback loops for detection coverage, fidelity, precision, reliability, time to detect, alert quality, operational performance, and analyst expertise
Define requirements for security data quality, normalization, enrichment, retention, availability, and observability
Provide technical leadership and coaching, mentor engineers and analysts, and participate in technical talent selection and development

Requirements

What you’ll need

4-year degree or equivalent experience
Continuing education to maintain thorough knowledge of technical and cybersecurity domains
10+ years of experience in cybersecurity engineering, detection engineering, threat hunting, security operations, security analytics, or related services
Ability to independently design, develop, validate, and improve detection capabilities in complex enterprise environments
Advanced Python programming and software engineering skills, including APIs, data structures, testing, code review, source control, packaging, error handling, and maintainable documentation
Experience with CI/CD, detection-as-code, and DevSecOps practices
Experience with automated testing, secure deployment, monitoring, rollback, versioning, and change governance
Strong hands-on experience with SIEM and security analytics platforms
Experience developing production-grade detection rules, correlation logic, behavioral analytics, enrichment, and alerting workflows
Familiarity with EDR, SOAR, threat intelligence, identity, cloud security, network security, case management, and malware analysis
Deep knowledge of detection engineering principles and security telemetry across endpoint, network, identity, cloud, and application environments
Understanding of adversary techniques and behaviors and ability to develop high-fidelity, explainable, and operationally sustainable detections
Strong understanding of secure systems design and operations, including authentication and authorization, secrets management, logging and telemetry, data handling, resilience, failure recovery, and reliable production operations
Experience with REST APIs, SQL/NoSQL data stores, Git, PowerShell or Bash, containers/Kubernetes, cloud technologies, and large-scale security data platforms
Understanding of business fundamentals and ability to translate business and cyber risk into technical strategy
Proven leadership, influence, interpersonal skills, sound judgment, and calm decision-making in time-sensitive situations
Excellent verbal, written, and presentation skills
Strong planning and organizational skills and commitment to teamwork and team effectiveness

Benefits

Comp & perks

Comprehensive health benefits, which may include medical, vision, dental, and life insurance
401(k)
Employee discount
Short-term disability
Long-term disability
Paid sick leave
Paid national holidays
Paid vacation
Financial, education, and well-being benefits and programs
Remote work arrangement with work-from-home or alternate-location flexibility
Remote team members may travel to HQ up to 4 times a year