Cyber Security Engineer

NTT DATA is seeking a Cyber Security Engineer to join its Security Operations team in Charlotte, North Carolina. The role focuses on designing, developing, tuning, and maintaining threat detections across cloud and on-premises environments, while improving telemetry ingestion, detection automation, monitoring coverage, and cyber defense capabilities.

Responsibilities:

• Design, develop, tune, and maintain threat detection logic across cloud and on-premises environments to improve visibility, alert quality, and response effectiveness
• Build and maintain efficient data ingestion and log onboarding pipelines for security-relevant telemetry from infrastructure, applications, endpoints, identity platforms, and cloud services
• Partner with threat intelligence teams to translate emerging threats, attacker techniques, and indicators of compromise into actionable detection strategies
• Collaborate with security analysts, incident responders, SOC engineers, and cross-functional technology teams to investigate detections, validate coverage, and reduce time to detect and respond
• Develop and fine-tune detection rules, signatures, correlation logic, behavioral analytics, and alerting thresholds to improve fidelity and reduce false positives
• Map detections and coverage to relevant frameworks, including MITRE Telecommunication&CK, to support measurable improvements in monitoring and response capabilities
• Use automation, scripting, and detection-as-code practices to improve consistency, scalability, testing, deployment, and lifecycle management of detection content
• Evaluate security monitoring technologies, data sources, and analytics capabilities to identify opportunities to enhance detection coverage and operational efficiency
• Ensure detection engineering practices align with applicable compliance, regulatory, and internal control requirements
• Create and maintain clear documentation for detection logic, data sources, tuning decisions, operational procedures, and response playbooks
• Continuously assess the effectiveness of cybersecurity monitoring controls and recommend improvements to strengthen SMBC's cyber resilience

Requirements:

• • Minimum of 3 years of relevant cybersecurity, detection engineering, SOC engineering, security analytics, or security operations experience
• • Hands-on experience analyzing logs and security telemetry from multiple sources, including endpoint, network, identity, cloud, infrastructure, and application platforms
• • Experience with cloud SIEM, UEBA, EDR, SOAR, data lake, or related detection and monitoring technologies
• • Strong knowledge of query languages and data analysis techniques used to investigate security events and develop detection logic
• • Experience developing detection-as-code pipelines, automation, scripts, or repeatable processes to improve security operations efficiency
• • Ability to translate threat intelligence, adversary behaviors, and attack techniques into practical detections and monitoring use cases
• • Experience mapping detections to MITRE Telecommunication & CK or similar security frameworks
• • Working knowledge of Windows and Linux operating systems, common enterprise infrastructure, and cloud environments
• • Strong troubleshooting, analytical, and problem-solving skills, with the ability to identify root cause and recommend practical improvements
• • Ability to balance operational responsibilities with project delivery in a fast-paced environment
• • Strong documentation, communication, collaboration, and stakeholder management skills
• • Demonstrated ownership, attention to detail, and ability to work effectively in a global team environment
• • Additional cybersecurity experience in incident response, threat intelligence, vulnerability management, security engineering, or cloud security is a plus