Senior Threat Engineer – AI-Powered Detection, Response & Continuous AI Red Teaming

Job not on LinkedIn

🔥 47 minutes ago

🇺🇸 United States – Remote

💵 $137k - $190.6k / year

⏰ Full Time

🟠 Senior

🤖 AI Engineer

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

CDW

WebsiteLinkedInAll Job Openings

10,000+ employees

Founded 1984

💼 Consulting

🏥 Healthcare

📚 Education

💰 Post-IPO Equity on 2015-07

Consulting • Healthcare • Education

CDW is a leading provider of technology solutions, offering a comprehensive range of products and services to address the needs of enterprises, government, healthcare, and education sectors. They specialize in providing IT infrastructure services, managed services, and security solutions. CDW partners with top technology brands to deliver customized solutions that enhance business productivity and performance across various industries. With a strong focus on digital transformation, security, and cloud solutions, CDW supports businesses in navigating the complexities of modern IT environments. Their expertise spans several domains, including digital workspaces, cybersecurity, and enterprise solutions, making CDW a key partner in driving technological advancements.

📋 Description

• Engineer high-fidelity detections across identity, endpoint, network, cloud, and SaaS, pairing each with automated response paths • Apply AI and machine learning to triage, correlate, and enrich alerts into incident narratives • Build autonomous and semi-autonomous playbooks to isolate hosts, revoke sessions and tokens, disable credentials, block infrastructure, and quarantine content • Implement confidence thresholds, blast-radius controls, human-in-the-loop escalation, and tested rollback paths • Measure mean time to detect, mean time to contain, false-positive rate, and MITRE ATT&CK coverage • Use LLMs and agentic tooling for investigation summaries, containment recommendations, indicator extraction, and human-reviewed detection logic generation • Operate continuous automated adversary emulation against production controls • Generate and mutate attack behavior across ATT&CK techniques using AI • Convert emulation misses into detection backlog items and noisy hits into tuning tasks, then automatically re-test fixes • Red team AI systems for evasion, prompt injection, data poisoning, and unsafe autonomous action • Operate safe production emulation with scoped targets, rate limits, abort criteria, deconfliction, and audit trails • Report living coverage metrics and prioritize the detection roadmap • Track adversary tradecraft and translate intelligence into emulation plans, detections, and response actions • Run hypothesis-driven hunts across SIEM, XDR, identity, and cloud telemetry • Lead technical deep dives on incidents and emulation findings • Develop Python integrations and tooling against platform APIs and event-driven architectures • Build self-healing detection and response capabilities that identify and correct telemetry gaps, sensor degradation, and control drift • Partner with Threat Response, Cyber Defense Engineering, security platform owners, and business unit owners • Contribute to backlogs and design reviews, mentor engineers and analysts, and document detection and automation decisions

🎯 Requirements

• Bachelor’s degree and 7+ years of experience in threat detection engineering, threat hunting, incident response, or offensive security, or 11+ years of equivalent experience • Hands-on experience building and tuning detections in SIEM platforms and cloud-scale security tooling • Practical working knowledge of the MITRE ATT&CK framework • Experience with adversary emulation, purple teaming, breach and attack simulation, or penetration testing against production controls • Proficiency in Python for production-grade automation and tooling • Experience applying AI/ML or LLM-based capabilities to security problems • Experience designing secure, observable, and maintainable AI-enabled solutions • Working experience with security automation, orchestration, or SOAR platforms • Experience building detection and response capability for large, diverse enterprise environments is a plus • Familiarity with Microsoft Defender, Microsoft Sentinel, CrowdStrike, Tines, Entra ID, and Splunk is a plus • Familiarity with Atomic Red Team, Caldera, Cobalt Strike, or commercial breach and attack simulation platforms is a plus • Detection-as-code practice, including CI/CD pipelines, infrastructure-as-code, policy-as-code, and automated testing, is a plus • Experience securing or red teaming AI systems, including prompt injection, model evasion, and agent safety testing, is a plus • Relevant certifications such as GCIH, GCFA, GCTI, GPEN, OSCP, Azure Security, or cloud and automation certifications are a plus

🏖️ Benefits

• Annual bonus target 10% subject to terms and conditions of plan • Benefits provided; details available at https://cdw.benefit-info.com/ • AI-fluent, curiosity-driven learning and experimentation culture • Equitable, transparent, and respectful hiring process • Support for professional growth and contributions in a collaborative environment