Role Summary
We are looking for an experienced Cloud Security Detection Engineer with strong expertise in detection engineering, security data engineering, and cloud-based threat detection. The ideal candidate will be responsible for developing and improving security detection capabilities using cloud security telemetry, particularly Azure Front Door, AWS CloudFront, and Web Application Firewall (WAF) logs.
This role will focus on addressing challenges with unparsed and unstructured security logs, building reliable log ingestion and parsing pipelines, normalizing security data, and developing actionable detection logic to identify malicious web traffic, application-layer attacks, and suspicious cloud activity.
The successful candidate will bridge security engineering and data engineering to ensure that raw cloud telemetry is transformed into structured, searchable, and actionable security intelligence.
1. Detection Engineering
- Design, develop, and maintain security detection rules for cloud infrastructure, web applications, and network traffic.
- Develop detection logic to identify malicious activities, suspicious HTTP requests, application-layer attacks, and anomalous traffic patterns.
- Build and enhance detections for SQL injection, Cross-Site Scripting (XSS), bot activity, API abuse, and WAF bypass attempts.
- Improve detection coverage, reduce false positives, and optimize alert quality.
- Translate threat intelligence and attack techniques into actionable detection use cases.
2. Security Data Engineering & Log Processing
- Develop and maintain pipelines for collecting, ingesting, parsing, and normalizing security telemetry.
- Address challenges involving raw, unparsed, or inconsistently structured security logs.
- Transform security logs into structured and searchable datasets for detection and investigation.
- Extract and normalize relevant fields, including source IP, destination, URL, HTTP method, response codes, user agents, WAF rule IDs, and security actions.
- Ensure data quality, completeness, consistency, and availability for security analytics.
3. Azure Front Door & WAF Detection
- Work with Azure Front Door and Azure Web Application Firewall (WAF) logs.
- Investigate and resolve issues involving unparsed or improperly structured Front Door security logs.
- Build parsing and normalization logic to make Front Door telemetry usable for security monitoring.
- Develop detection rules for suspicious web requests, malicious traffic, and application-layer threats.
- Improve visibility into WAF rule matches, blocked requests, and potential attack patterns.
4. AWS CloudFront & WAF Detection
- Develop detection capabilities using AWS CloudFront and AWS WAF logs.
- Analyze CDN and WAF telemetry to identify malicious requests and suspicious traffic patterns.
- Create detection rules for common web application attacks, bot activity, and attempts to bypass security controls.
- Integrate CloudFront and WAF telemetry into SIEM and security analytics platforms.
- Improve cloud application security monitoring and threat visibility.
5. Security Analytics & SIEM Integration
- Integrate processed security telemetry with SIEM and security analytics platforms.
- Develop and maintain detection content, correlation rules, alerts, and dashboards.
- Work with security operations and incident response teams to improve threat investigation capabilities.
- Document detection logic, data pipelines, parsing standards, and operational procedures.
Required Technical Skills
- Strong hands-on experience in Detection Engineering and Security Data Engineering.
- Experience with cloud security telemetry, log ingestion, parsing, normalization, and transformation.
- Practical experience with Azure Front Door logs and Azure WAF.
- Experience with AWS CloudFront and AWS WAF logging and detection.
- Strong understanding of HTTP/HTTPS traffic, web application architecture, and API security.
- Experience developing SIEM detection rules, correlation logic, and security analytics.
- Proficiency in Python, SQL, KQL, or other scripting/query languages.
- Experience with security data pipelines and log processing frameworks.
- Understanding of web application attacks, including SQL injection, XSS, bot attacks, and API abuse.
Preferred Qualifications
- Experience with Microsoft Sentinel, Splunk, Elastic Security, or similar SIEM platforms.
- Familiarity with Azure Monitor, Log Analytics, AWS CloudWatch, and S3-based log processing.
- Knowledge of MITRE ATT&CK and detection engineering frameworks.
- Experience developing custom parsers, field mappings, and data normalization standards.
- Experience identifying and resolving telemetry ingestion and parsing issues.
- Knowledge of cloud networking, CDN architecture, reverse proxies, and application security.
- Experience improving detection coverage and reducing false-positive alerts.
Ideal Candidate Profile
The ideal candidate will be a hands-on security engineer who understands both the data engineering and security detection aspects of cloud environments. They should be comfortable working with raw cloud logs, troubleshooting parsing issues, developing security data pipelines, and building detection logic that identifies real-world threats.
Candidates with direct experience in Azure Front Door/WAF and AWS CloudFront/WAF detection engineering will be particularly relevant.