Cybersecurity Threat Detection Engineer

About the role

The ICE Cybersecurity Threat Detection team detects malicious behaviour across ICE's global infrastructure quickly and reliably enough to contain it. You will build, tune and maintain detection content used by security operations teams, proactively hunt for threats missed by existing controls, and work alongside threat intelligence, incident response and red team functions.

Key responsibilities

• Detection engineering: design, build, test and maintain detection content across SIEM, EDR and NDR platforms, documenting intent, data source and expected behaviour.
• Tuning and health: own false positive rates, alert volume and rule health, and retire logic that no longer earns its place.
• Coverage mapping: map detection coverage to the MITRE ATT&CK framework, identify gaps and propose telemetry or logic to close them.
• Threat intelligence integration: turn threat intelligence reports into prioritised detection and hunting work aligned to the sector's adversaries and techniques.
• Proactive threat hunting: run focused hunts to find threats evading existing controls and promote successful results into production detections.
• Red team gap remediation: own detection gaps found in red and purple team exercises, track them to closure and validate coverage on retest.
• Log source health: validate log completeness, detect collection failures and silent feeds, and onboard or update SIEM log sources.
• Automation and tooling: use scripting to build internal tools, process and normalise data and remove repetitive manual work.

Required profile

• University degree in Engineering, MIS, CIS or a related discipline, or equivalent experience.
• 3+ years of relevant experience in threat detection, security operations or threat hunting.
• Ability to investigate suspicious activity end to end and communicate conclusions clearly.
• Familiarity with the MITRE ATT&CK framework and reasoning about adversary tradecraft.

Required skills

• Hands-on experience with SIEM, EDR and NDR platforms, including writing and tuning detection logic.
• Scripting language for automation, at the level needed to build internal tooling.
• Preferred: Sigma rules, detection-as-code (Git, peer review, automated testing, pipelines), structured hunting methods (PEAK, TaHiTI), applied AI engineering in security, malware analysis, forensics or reverse engineering.