> Markdown version of [/jobs/ext/2832922-threat-engineer-ai-powered-detection-response-continuous-ai-red-teaming](https://www.wearedevelopers.com/jobs/ext/2832922-threat-engineer-ai-powered-detection-response-continuous-ai-red-teaming). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Threat Engineer - AI-Powered Detection, Response & Continuous AI Red Teaming

- **Company:** CDW
- **Location:** United States
- **Experience:** Expert
- **Salary:** $41,600.0 - $58,240.0
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Software System Penetration Testing, Automation of Tests, Microsoft Azure, Software as a Service, Continuous Integration, Emulators, Intrusion Detection and Prevention, Python (Programming Language), Red Team (Cyber Security), Security Information and Event Management, Policy as Code, Large Language Models, Mitre Att&ck, Cyber Threat Analysis, Event Driven Architecture, Information Technology, Cybercrime, Microsoft Sentinel, Cyber Warfare, Splunk, Security Orchestration, Automation & Response
- **Published:** September 10, 2026
- **Apply:** https://www.builtincolorado.com/job/senior-threat-engineer-ai-powered-detection-response-continuous-ai-red-teaming/11081742?handler=ApplyRedirect

## About the Role

* Bachelor's degree and 7+ years of experience in threat detection engineering, threat hunting, incident response, or offensive security, or 11+ years of equivalent experience.
 * Hands-on experience building and tuning detections in SIEM platforms and cloud-scale security tooling.
 * Practical working knowledge of the MITRE ATT&CK framework, including mapping detections and automated responses to techniques.
 * Experience with adversary emulation, purple teaming, breach and attack simulation, or penetration testing against production controls.
 * Proficiency in Python for production-grade automation and tooling.
 * Experience applying AI/ML or LLM-based capabilities to security problems, and designing secure, observable, and maintainable AI-enabled solutions.
 * Working experience with security automation, orchestration, or SOAR platforms.
 * Built detection and response capability for large, diverse enterprise environments, a plus.
 * Familiarity with platforms such as Microsoft Defender, Microsoft Sentinel, CrowdStrike, Tines, Entra ID, and Splunk, a plus.
 * Familiarity with emulation and offensive tooling such as Atomic Red Team, Caldera, Cobalt Strike, or commercial breach and attack simulation platforms, a plus
 * Detection-as-code practice: CI/CD pipelines, infrastructure-as-code, policy-as-code, and automated testing of detection content, a plus.
 * Experience securing or red teaming AI systems, including prompt injection, model evasion, and agent safety testing, a plus

## Description

Job Summary Catch attackers in minutes, not days. Test our own defenses at attacker speed, continuously. The Senior Threat Engineer is a hands-on, high-impact role within the Enterprise Defense & Automation (EDA) team. You will engineer AI-powered detection and response capabilities that compress attacker dwell time from days to minutes, and you will continuously red team those same defenses at attacker speed so that gaps are found by us long before they are found by an adversary. The role sits at the intersection of threat detection engineering, adversary emulation, and applied AI. On the defensive side you will build detections and AI-assisted response paths that triage, decide, and act autonomously within policy, moving security operations from "alert and investigate" to detect, decide, and act. On the offensive side you will run continuous, automated adversary emulation against production controls, generating a constant stream of evidence about what our defenses actually stop. This
is a builder and problem-solver role. You will write detection logic, adversary emulation content, and automated response playbooks; instrument them with measurable outcomes such as mean time to detect, mean time to contain, and detection coverage against MITRE ATT&CK; and use AI to raise signal fidelity rather than alert volume. Every detection you ship is expected to be tested by an emulation you also ship. Success requires strong threat fundamentals, fluency across modern detection and response platforms, and the discipline to deliver production-grade capability that holds up in real-world, adversarial conditions. Guardrails matter as much as speed: confidence thresholds, blast-radius limits, and rollback paths are part of the design, not an afterthought. If you are energized by hunting real adversaries, teaching machines to respond faster than they can, and attacking your own work before anyone else gets the chance, this role puts you at the forefront of modern cyber defense.
What you will do AI-Powered Detection & Response - catch attackers in minutes, not days (Primary)

 * Engineer high-fidelity detections across identity, endpoint, network, cloud, and SaaS, and pair each one with an automated response path so the outcome is containment, not another alert.
 * Apply AI and machine learning to triage, correlate, and enrich alerts at machine speed - clustering related signals into a single incident narrative and surfacing the attacker story instead of a queue of fragments.
 * Build autonomous and semi-autonomous response playbooks that isolate hosts, revoke sessions and tokens, disable credentials, block infrastructure, and quarantine content within minutes of first signal.
 * Implement the guardrails that make autonomy safe: confidence thresholds, blast-radius controls, human-in-the-loop escalation for high-impact actions, and tested rollback for every automated action.
 * Instrument detection and response for measurable outcomes - mean time to detect, mean time to contain, false-positive rate, and ATT&CK coverage - and drive those numbers down release over release.
 * Use LLMs and agentic tooling where they earn their place: summarizing investigations, drafting containment recommendations, extracting indicators from unstructured reporting, and generating detection logic that a human reviews before it ships. Continuous AI Red Teaming - test our own defenses at attacker speed (Primary)
 * Stand up and operate continuous, automated adversary emulation against production controls, so defensive coverage is proven by evidence on a recurring cadence rather than assumed between annual assessments.
 * Use AI to generate and mutate attack behavior - varying tradecraft, tooling, and sequencing across ATT&CK techniques - so detections are tested against variants rather than a single static signature.
 * Close the loop from emulation to engineering: every miss becomes a detection backlog item, every noisy hit becomes a tuning task, and every fix is re-tested automatically.
 * Red team our AI itself - test detection models, agents, and prompts for evasion, prompt injection, data poisoning, and unsafe autonomous action, and remediate what you find.
 * Operate emulation safely in production: scoped targets, rate limits, clear abort criteria, deconfliction with the response team, and full audit trails for every executed technique.
 * Report coverage as a living metric - which techniques are prevented, which are detected, which are only logged, and which are invisible - and use it to prioritize the detection roadmap. Threat Research & Hunting
 * Track adversary tradecraft relevant to CDW and our customers, and translate intelligence into emulation plans, detections, and response actions rather than reading material.
 * Run hypothesis-driven threat hunts across SIEM, XDR, identity, and cloud telemetry, and convert every confirmed hunt technique into an automated detection so the same hunt never has to be run by hand twice.
 * Map techniques to controls and automated responses once, then reuse the mapping globally across the estate.
 * Lead technical deep dives on significant incidents and emulation findings, and feed the lessons back into detection content, response playbooks, and platform hardening. Detection Engineering as Code
 * Treat detection content as software: version controlled, peer reviewed, unit tested against emulation data and promoted through CI/CD with security gates that block low-quality logic before it reaches production.
 * Develop integrations and tooling in Python against platform APIs and event-driven architectures, favoring reusable services over one-off scripts.
 * Build detection and response capability that self-heals - identifying telemetry gaps, sensor degradation, and control drift, then correcting them or rolling back to a known-good state without waiting for a human.
 * Eliminate repeat findings through native auto-remediation patterns rather than recurring manual cleanup. Collaboration & Influence
 * Partner closely with the Threat Response team, Cyber Defense Engineering, security platform owners, and business unit owners so that detections, emulations, and automated actions land with clear ownership boundaries.
 * Contribute to shared backlogs and design reviews, and mentor engineers and analysts on detection quality, adversary tradecraft, and the safe use of AI in the defensive stack.
 * Document detection logic, emulation plans, automation patterns, and engineering decisions so the capability survives any single person. What we expect of you, Provides operational order support from order entry through invoicing. Processes web orders, bids, contracts, installs, and purchasing terms; maintains sales order systems; resolves order holds and issues; follows up on ServiceNow requests; and communicates order status, shipping, and logistics information to account teams, coworkers, and customers., Design, implement, support, and optimize large-scale virtualized data center environments for managed services clients. Provide advanced troubleshooting, infrastructure planning, performance analysis, capacity management, technical documentation, customer consulting, training, and 24/7 on-call support. Serve as a technical point of contact, lead design workshops, execute technology projects, maintain service levels, improve procedures, and mentor teams on virtualization technologies.
Top Skills: Backup TechnologiesCisco HyperflexCisco UcsCisco Ucs PowertoolDellFirewall InfrastructureHpeItilMicrosoft PowershellNutanixReplication TechnologiesRoutingSwitchingVMwareVmware PowercliVmware Vsan
CDW, Provides sales operations and order management support to account managers and customers. Responsibilities include quote creation, order processing, contract compliance, bid management, customer updates, escalation resolution, order release, rollout coordination, and maintenance of sales systems. The role also mentors coworkers, supports services requests, develops product and contract expertise, and maintains trusted customer and internal relationships.
Top Skills: AgiloftAs400Bid RouterCertiniaCpqMS OfficeSales Order RouterServicenowSpsSynapse

What you need to know about the Colorado Tech Scene

With a business-friendly climate and research universities like CU Boulder and Colorado State, Colorado has made a name for itself as a startup ecosystem. The state boasts a skilled workforce and high quality of life thanks to its affordable housing, vibrant cultural scene and unparalleled opportunities for outdoor recreation. Colorado is also home to the National Renewable Energy Laboratory, helping cement its status as a hub for renewable energy innovation.

Key Facts About Colorado Tech

 * Number of Tech Workers: 260,000; 8.5% of overall workforce (2024 CompTIA survey)
 * Major Tech Employers: Lockheed Martin, Century Link, Comcast, BAE Systems, Level 3
 * Key Industries: Software, artificial intelligence, aerospace, e-commerce, fintech, healthtech
 * Funding Landscape: $4.9 billion in VC funding in 2024 (Pitchbook)
 * Notable Investors: Access Venture Partners, Ridgeline Ventures, Techstars, Blackhorn Ventures
 * Research Centers and Universities: Colorado School of Mines, University of Colorado Boulder, University of Denver, Colorado State University, Mesa Laboratory, Space Science Institute, National Center for Atmospheric Research, National Renewable Energy Laboratory, Gottlieb Institute


## Related Videos

- [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime)
- [WWC24 - Chris Wysopal, Helmut Reisinger and Johannes Steger - Fighting Digital Threats in the Age of AI](https://www.wearedevelopers.com/videos/926-wwc24-chris-wysopal-helmut-reisinger-and-johannes-steger-fighting-digital-threats-in-the-age-of-ai)
- [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats)
- [Our journey with Spring Boot in a microservice architecture](https://www.wearedevelopers.com/videos/511-our-journey-with-spring-boot-in-a-microservice-architecture)
- [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see)
- [WeAreDevelopers LIVE – Web Scraping, Agents, Actors and more](https://www.wearedevelopers.com/videos/1764-wearedevelopers-live-web-scraping-agents-actors-and-more)

## Related Articles

- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [How to Become an AI Engineer](https://www.wearedevelopers.com/magazine/331-how-to-become-an-ai-engineer)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Navigating the AI Shift](https://www.wearedevelopers.com/magazine/629-navigating-the-ai-shift)
- [Dev Digest 164: AI Agents, AI Blindspots and MCP security problems](https://www.wearedevelopers.com/magazine/578-dev-digest-164-ai-agents-ai-blindspots-and-mcp-security-problems)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)