Detection Engineer
$100,000–$140,000 year
Hybrid · Chicago, Illinois, United States
Chicago, Illinois, United StatesHybridFull Time$100,000–$140,000 yearMid LevelNot SpecifiedUnknown
Type
Full Time
Level
Mid Level
Education
Not Specified
Company size
Unknown
Job Summary
Detection Engineer role within Tempus Security Operations Center building data pipelines to ingest security events into a SIEM, develop Python APIs, tests, and CI; contribute to agentic SOC workflows with human-in-the-loop guardrails; responsibilities include building/maintaining log ingestion, normalizing events, testing with mocked APIs, operating pipelines, validating data in SIEM, improving detection-as-code, code reviews, and contributing to SOAR automations.
Required Qualifications
- Comfortable building Python—APIs and JSON, basic error handling, and tests in a managed project (Poetry or similar)
- Ability to integrate systems via APIs—OAuth or API keys, retries, and handling partial failures
- Testing discipline—unit tests, readable failures, and fixing regressions you introduce before merge
- Git and collaborative development—small, reviewable changes with clear descriptions of risk and rollout
- Temperament for long-horizon work—you can focus on incremental pipeline quality while understanding it enables agentic SOC capabilities over time
- Strong problem-solving skills and curiosity about security operations; willingness to learn detection concepts with mentorship
- Bonus points for: Experience with scheduled jobs or Docker
- Hands-on SIEM exposure from coursework, CTFs, labs, or internships (e.g. Splunk, Google SecOps, Microsoft Sentinel)
- Can navigate cloud primitives on GCP, Azure, or AWS (S3/GCS/Blob, Key Vault/Secret Manager/Secrets Manager, IAM roles and service principals)
- Experience with infrastructure as code (e.g. Terraform)
- Strong understanding of IAM principles in GCP (least privilege, service accounts, workload identity, and role bindings)
Apply with one swipe on Sorce. We auto-fill applications and apply on your behalf — no cover letters, no 40-minute forms.
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.