{"id":2117620,"url":"https://alion.io/job/f5-networks-security-detection-engineer-iii","title":"Security Detection Engineer III","company":{"id":2309069,"name":"F5","domain":"lolportals.com","url":"https://alion.io/company/lolportals","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Warsaw, Poland","Hyderabad, Pakistan","Guadalajara, Mexico"],"countries":["PL","PK","MX"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":49000,"max_usd":86000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":16},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"CI/CD","optional":false},{"name":"Platform Engineering","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"SQL","optional":false},{"name":"Crowdstrike","optional":true},{"name":"Git","optional":true},{"name":"LLM","optional":true},{"name":"Microsoft Sentinel","optional":true},{"name":"OWASP","optional":true},{"name":"Splunk","optional":true}],"status":"live","first_seen_at":"2026-09-22T11:09:37Z","employer_posted_date":null,"last_verified_at":"2026-09-22T11:09:37Z","board_verified":false,"closed_at":null,"days_open":19,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":19},"description":"About F5\n\nAt F5, we strive to bring a better digital world to life. Our teams empower organizations across the globe to create, secure, and run applications that enhance how we experience our evolving digital world. We are passionate about cybersecurity, from protecting consumers from fraud to enabling companies to focus on innovation. Everything we do centers around people. That means we obsess over how to make the lives of our customers, and their customers, better. And it means we prioritize a diverse F5 community where each individual can thrive.\n\nRole Overview\n\nThe Security Engineer III, Detection Engineering is a career-level security engineering professional responsible for developing, testing, deploying, and continuously improving detection capabilities that support Security Operations. As part of the Security Operations Platform Engineering (SOPE) team, this role focuses on transforming threat intelligence, telemetry, and security requirements into reliable, actionable detections that improve visibility and reduce organizational risk. The engineer partners closely with Incident Response, Threat Intelligence, Logging Engineering, and platform engineering teams to build scalable, threat-driven detection capabilities while advancing automation, detection coverage, and operational maturity.\n\nPrimary Responsibilities\n\nDevelop and maintain custom detections using Detection-as-Code practices, including version control, peer review, testing, and CI/CD deployment workflows.\n\nAnalyze and improve detection coverage by mapping telemetry and detections to adversary behaviors and the MITRE ATT&CK framework, identifying gaps and prioritizing enhancements.\n\nPartner with Incident Response, Threat Intelligence, Logging Engineering, and security platform teams to translate emerging threats, investigations, and telemetry into actionable detection content.\n\nValidate and tune detections through adversary emulation, atomic testing, purple-team exercises, and production feedback to improve signal quality and reduce false positives.\n\nAutomate and optimize detection engineering workflows, alert enrichment processes, and operational activities to improve efficiency and scalability.\n\nSupport onboarding of new log sources and security telemetry by collaborating with engineering and infrastructure teams to establish detection coverage across new environments and technologies.\n\nCreate and maintain detection documentation, runbooks, coverage assessments, and technical standards while participating in an engineering on-call rotation.\n\nHelp define detection strategy for AI and agentic systems (prompt injection, tool and function abuse, agent identity and credential misuse, data exfiltration via model outputs), and explore using AI to accelerate detection engineering workflows.\n\nWymagania\nRequired Skills / Qualifications\n\nBachelor's degree in Information Security, Computer Science, Engineering, or related field, or equivalent practical experience.\n\n5+ years of experience in cybersecurity, security engineering, detection engineering, security operations, threat hunting, or a related discipline.\n\nExperience developing, tuning, or maintaining detections within a SIEM, EDR, log analytics, or security monitoring platform.\n\nExperience with scripting, automation, or data analysis using Python, PowerShell, SQL, KQL, SPL, or similar technologies.\n\nStrong understanding of attacker techniques, detection methodologies, and frameworks such as MITRE ATT&CK.\n\nStrong analytical, problem-solving, communication, and cross-functional collaboration skills.\n\nPreferred Skills / Qualifications\n\nExperience implementing Detection-as-Code practices, including Git-based workflows, automated testing, and CI/CD pipelines.\n\nExperience with adversary emulation, atomic testing, purple-team exercises, or detection validation frameworks.\n\nExperience performing detection coverage analysis and developing ATT&CK-based coverage roadmaps.\n\nExperience onboarding log sources and building detections across cloud, endpoint, network, identity, or SaaS environments.\n\nExperience with platforms such as CrowdStrike, Splunk, Microsoft Sentinel, Chronicle, Elastic, or similar security technologies.\n\nFamiliarity with AI/LLM threat models (prompt injection, tool and function abuse, agent identity and credential misuse, data exfiltration via model outputs) or frameworks such as MITRE ATLAS and the OWASP LLM Top 10 — and interest in applying AI to accelerate detection engineering workflows.\n\nOferujemy\nThis is a full-time engineering role and is not a shift-based position. Participation in an engineering on-call rotation is required and may occasionally require support outside normal business hours during critical incidents, platform outages, or detection-related operational events. The Security Engineer III may be engaged as a subject matter expert during security incidents but is not responsible for primary incident response or SOC operations. Travel may be required up to 5%, including occasional international travel.","description_format":"text","description_chars":5034,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security"],"lifecycle":[{"event":"open","at":"2026-10-08T23:22:33Z"}],"visa":[],"liveness":{"score":34,"band":"fade","label":"Fading","p_open":0.85,"p_active":0.718,"p_room":0.55,"age_days":19,"expected_fill_days":19,"reasons":["seen:19","win:tail"],"computed_at":"2026-10-12T06:55:09Z"},"pay":null,"html_url":"https://alion.io/job/f5-networks-security-detection-engineer-iii","json_url":"https://alion.io/job/f5-networks-security-detection-engineer-iii.json","meta":{"generated_at":"2026-10-12T09:30:51Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14484,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2309069},"rest":"https://alion.io/mcp/rest/get_company?id=2309069"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ff5-networks-security-detection-engineer-iii"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ff5-networks-security-detection-engineer-iii"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ff5-networks-security-detection-engineer-iii"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/f5-networks-security-detection-engineer-iii\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ff5-networks-security-detection-engineer-iii"}]}