Senior Threat Detector

Capital One•McLean, VA

About The Position

Senior Threat Detector Capital One’s Cyber Organization is a fast-paced, dynamic environment committed to enabling and securing the business. Our Cyber Operations & Intelligence division is searching for an experienced Individual Contributor (IC), Principal Associate to contribute to our Detection Engineering team. In this role, you will be responsible for solving hard problems using cutting edge technology in the areas of security testing, engineering, alert development, and monitoring. Primary Responsibilities: AI-Driven Detection & Engineering: Leverage LLMs and machine learning to automate detection logic, summarize complex attack chains, and reduce false positives. Detection-as-Code (DaC): Lead the design and maintenance of detection rules using DaC methodologies, utilizing GenAI assistants to accelerate development and unit testing. Strategic Architecture: Drive the integration of data science concepts into threat detection and utilize the MITRE ATT&CK framework to visualize and close coverage gaps. Offensive Alignment & Hunting: Conduct hypothesis-driven threat research and apply a deep understanding of Red Team methodologies to translate attacker TTPs into high-fidelity detections. Stakeholder & Risk Management: Partner with business leaders to ensure robust monitoring across cloud, network, and applications while ensuring all documentation meets strict fintech compliance and audit standards. Mentorship: Serve as a technical bar-raiser, mentoring junior engineers on both traditional security concepts and emerging AI-driven workflows. Ability to conduct proactive threat research across enterprise environments using hypothesis driven methodologies Develop and implement best practices to identify malicious activity in a dynamic, fast-paced environment Understand the business drivers of the enterprise and partner with relevant stakeholders to ensure robust monitoring and expanded coverage across our hosts, networks, and applications. Demonstrate a deep understanding of adversary techniques and emerging threats that could impact business operations Respond to inquiries from regulatory entities, risk management and audit teams, providing clear and complete documentation of procedures and workflows Experience mentoring junior engineers and contribute to a culture of continuous improvement and knowledge sharing Ability to articulate security risks and detection strategies to technical and executive audiences About you:

Requirements

Previous experience with a detection engineering, threat detection, or detection operations team
Extensive experience in SQL
Strong understanding of attacker TTPs, red team methodologies, and translating offensive security insights into detections
Excellent analytical, communication, and leadership skills
Must be able to perform root cause analysis independently or collaboratively with team
Customer service and stakeholder engagement skills
Strong decision-making and strategic thinking in threat detection
High School Diploma, GED, or equivalent certification
At least 3 years of experience in Information Technology or Cyber Security
At least 2 years of experience with host, cloud, application or network logs
At least 2 years of experience developing alerts for threat detection
At least 2 years of penetration testing or offensive security experience

Nice To Haves

Bachelor’s Degree in Information Technology, Cyber Security or Computer Science or similar programs
4+ years of experience in Threat Detection, Threat Hunting, or Security Engineering
4+ years of experience with data science concepts and techniques
4+ years of experience with Python
1+ years of experience in publishing code to GitHub
GCIA, GCIH, CISSP, GMON, GREM, GCTD, MLE, OR Cloud (GCP, AWS) certifications

Responsibilities

AI-Driven Detection & Engineering: Leverage LLMs and machine learning to automate detection logic, summarize complex attack chains, and reduce false positives.
Detection-as-Code (DaC): Lead the design and maintenance of detection rules using DaC methodologies, utilizing GenAI assistants to accelerate development and unit testing.
Strategic Architecture: Drive the integration of data science concepts into threat detection and utilize the MITRE ATT&CK framework to visualize and close coverage gaps.
Offensive Alignment & Hunting: Conduct hypothesis-driven threat research and apply a deep understanding of Red Team methodologies to translate attacker TTPs into high-fidelity detections.
Stakeholder & Risk Management: Partner with business leaders to ensure robust monitoring across cloud, network, and applications while ensuring all documentation meets strict fintech compliance and audit standards.
Mentorship: Serve as a technical bar-raiser, mentoring junior engineers on both traditional security concepts and emerging AI-driven workflows.
Ability to conduct proactive threat research across enterprise environments using hypothesis driven methodologies
Develop and implement best practices to identify malicious activity in a dynamic, fast-paced environment
Understand the business drivers of the enterprise and partner with relevant stakeholders to ensure robust monitoring and expanded coverage across our hosts, networks, and applications.
Demonstrate a deep understanding of adversary techniques and emerging threats that could impact business operations
Respond to inquiries from regulatory entities, risk management and audit teams, providing clear and complete documentation of procedures and workflows
Experience mentoring junior engineers and contribute to a culture of continuous improvement and knowledge sharing
Ability to articulate security risks and detection strategies to technical and executive audiences