> Markdown version of [/jobs/ext/1426706-senior-threat-engineer](https://www.wearedevelopers.com/jobs/ext/1426706-senior-threat-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Threat Engineer

- **Company:** Coalition Inc.
- **Location:** Boston, MA, United States (Remote available)
- **Experience:** Expert
- **Salary:** $100,000.0 - $150,000.0
- **Contract:** Permanent contract
- **Skills:** Cyber Security, Intrusion Detection and Prevention, Operational Data Store, Security Information and Event Management, Workflow Management Systems, Scripting, Cybercrime, Security Orchestration, Automation & Response
- **Published:** July 24, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=66595f6ce18cbf8b

## About the Role

* Significant experience in cybersecurity operations such as threat detection and response, detection engineering, incident response, threat hunting, or SOC operations
 * You look for repeatable patterns, clear decision logic, and ways to scale good judgment through automation rather than repeated manual work
 * Strong investigative and analytical skills, with the ability to turn ambiguous signals and messy operational problems into practical detection logic and workflow improvements
 * Experience building, tuning, or maintaining automations, detections, playbooks, rules, or enrichment pipelines in security tooling
 * Demonstrated ability to independently own complex technical or operational problem areas, step into ambiguity, and drive them to better outcomes
 * Interest in work that is different from a traditional analyst role: improving how work gets done rather than only executing it yourself
 * Strong written and verbal communication skills, including the ability to document logic and explain threats, tradeoffs, and outcomes clearly to customers and internal partnersAbility to work closely with product, engineering, and security stakeholders
 * Comfort using data to evaluate detection quality, workflow performance, and where the system needs improvement
 * Preference for simple, scalable solutions and willingness to reduce unnecessary complexity or manual work

Bonus Points

 * Experience working in high-volume security operations environment
 * Significant experience with detection and response tooling such as SIEM, EDR, SOAR, case management, and telemetry enrichment systems
 * Familiarity writing scripts or queries to support investigations, automation, or workflow analysis
 * Experience improving operational quality through experimentation, measurement, and continuous iteration
 * Experience in workflow design, detection engineering, automation, or security product development
 * Experience mentoring fellow engineers, setting technical direction, or influencing how a team approaches detection and response problems

## Description

A Senior Threat Engineer builds and improves systems, logic, and workflows that allow Coalition's Wirespeed Verdict Engine to make high-precision security decisions at scale.

Disclaimer: This is not a traditional SOC analyst role.

Success in this position is not defined by working one alert at a time, but by figuring out how to handle thousands of similar situations better, faster, and more consistently through automation, patterning, and engineering. Key focus will be studying how investigations should work, identifying repeatable decision points, and turning that thinking into detections, enrichment, triage logic, and automated response workflows.

As a senior member of the team, you'll be expected to take ownership of complex problem areas, exercise strong judgment in ambiguous situations, and help shape how the broader Threat Engineering function operates. This role is for someone who can bridge threat detection, engineering, and customer experience. Its ideal for someone who is more interesting asking, "How should this entire class of problem be solved?" rather than, "How do I close the next alert in the queue?"

If you are excited by designing systems that scale expert judgment, improving both customer outcomes and operational efficiency, and doing work that looks very different from a conventional analyst job, this role is for you.

Responsibilities

 * Design, build, and improve the detection, decisioning, and response workflows that power the Wirespeed Verdict Engine
 * Own complex threat detection and workflow problem spaces from investigation concept through implementation, validation, and iteration
 * Translate investigative thinking and threat research into scalable detections, enrichment, triage logic, and automated decisions that improve speed, accuracy, reliability, and customer outcomes
 * Analyze operational data to identify false positives, false negatives, latency issues, and opportunities to improve how entire categories of work are handled
 * Continuously raise the ceiling of what the system can do autonomously, reducing manual review while improving service quality and consistency
 * Support especially complex or novel cases when needed, then feed those lessons back into the system so similar situations can be handled better in the future
 * Keep the customer experience front and center by ensuring Wirespeed outputs are clear, helpful, accurate, and appropriately calibrated to the customer's situation
 * Identify patterns in customer pain, confusion, or friction and use those insights to improve verdict logic, response content, and overall product behavior
 * Partner closely with product, engineering, and security teams to improve platform capabilities, data quality, and operational leverage
 * Help define best practices, operating principles, and technical standards for Threat Engineering work
 * Document detection concepts, workflow logic, and operating principles so the team can scale knowledge
 * Provide technical leadership through strong execution, sound judgment, and mentorship of less experienced teammates, Coalition is committed to protecting your privacy and handling your personal information responsibly. We collect, use, and store personal information as necessary for the recruitment process and in compliance with applicable privacy laws and regulations in all regions where we operate. We want you to understand what personal information we collect, how we use it, and your rights regarding access, correction, and deletion of your data where applicable. Information submitted, collected, and processed as part of your application is subject to Coalition's Privacy Policy. For further details, please review our full Privacy Policy or contact us with any questions regarding how your information is handled.


## Related Videos

- [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data)
- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats)
- [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java)
- [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large)
- [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see)

## Related Articles

- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)