{"id":3201314,"url":"https://alion.io/job/intercontinental-exchange-cyber-security-engineer-threat-detection","title":"Cyber Security Engineer - Threat Detection","company":{"id":58612,"name":"Intercontinental Exchange","domain":"ice.com","url":"https://alion.io/company/intercontinental-exchange","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Jibe","truth_index":{"grade":"B","score":80,"open_postings":37,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":9,"computed_at":"2026-10-26T05:57:25Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":67000,"max_usd":152000,"period":"year","method":"role_country_seniority_unknown","sample_n":148},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"MITRE ATT&CK","optional":false},{"name":"Red Teaming","optional":false},{"name":"SIEM","optional":false},{"name":"Crowdstrike","optional":true},{"name":"ElasticSearch","optional":true},{"name":"Git","optional":true},{"name":"Linux","optional":true},{"name":"LLM","optional":true},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"SentinelOne","optional":true},{"name":"Splunk","optional":true},{"name":"Tanium","optional":true},{"name":"Windows","optional":true}],"status":"live","first_seen_at":"2026-09-08T14:30:00Z","employer_posted_date":"2026-10-24","last_verified_at":"2026-10-26T02:31:28Z","board_verified":true,"closed_at":null,"days_open":47,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":47},"description":"Job Purpose\nThe ICE Cybersecurity Threat Detection team is responsible for detecting malicious behavior across ICE's global infrastructure quickly and reliably enough to contain it. We build, tune, and maintain the detection content that security operation teams depend on, and hunt proactively for threats that existing controls do not catch, working alongside threat intelligence, incident response, and red team functions to keep coverage grounded in real adversary behavior.\nResponsibilities\nDetection Engineering - Design, build, test, and maintain detection content across SIEM, EDR, and NDR platforms, and document the intent, data source, and expected behavior of each detection\nDetection Tuning and Health - Own false positive rates, alert volume, and rule health for assigned detection areas, including retiring logic that no longer earns its place\nDetection Coverage - Map detection coverage to the MITRE ATT&CK framework, identify gaps, and propose the telemetry or logic needed to close them\nThreat Intelligence Integration - Convert threat intelligence reporting into prioritized detection and hunting work, so coverage follows the adversaries and techniques most relevant to the sector rather than whatever arrived most recently\nProactive Threat Hunting - Develop and execute focused hunts to discover threats that evade existing controls, and promote successful hunt outcomes into durable production detections\nRed Team Gap Remediation - Take ownership of detection gaps reported through red team and purple team exercises; track each gap to closure, build or amend the detection, and validate that the exercise activity is caught on retest\nLog Source Health - Validate the health and completeness of security log sources, detect collection failures and silent feeds, and onboard or update SIEM log sources in a timely manner\nAutomation and Tooling - Apply a developer and problem-solving mindset to the work, using scripting to build internal tooling, process and normalize data, and remove repetitive manual effort wherever it appears\nKnowledge and Experience\nRelevant experience in threat detection, security operations, or threat hunting\nHands on, day to day experience with SIEM, EDR, and NDR platforms, including writing and tuning detection logic\nWorking knowledge of a scripting language for automation, at the level needed to build useful internal tooling\nDemonstrated ability to investigate suspicious activity end to end: read the logs, form a conclusion, and communicate it clearly\nFamiliarity with the MITRE ATT&CK framework and the ability to reason about adversary tradecraft rather than only indicators\nSolid understanding of operating system internals, networking, and authentication as they appear in security telemetry\nUniversity degree in Engineering, MIS, CIS, or related discipline; or equivalent years of experience\nPreferred Experience\nAuthoring Sigma rules and working with portable, vendor neutral detection formats\nDetection as code practices, including Git workflows, peer reviewed rule changes, automated rule testing, and pipeline based deployment\nStructured hunting methodologies such as PEAK or TaHiTI, and experience hunting against a documented backlog rather than ad hoc\nApplied AI engineering in a security context, including use or development of LLM assisted tooling for triage, enrichment, rule drafting, or log summarization, together with a realistic understanding of where these systems fail and how to evaluate their output\nMalware analysis, digital forensics, or reverse engineering fundamentals\nSpecific Technologies\nSIEM platforms including Splunk and Elasticsearch. Endpoint detection and response platforms including Tanium, CrowdStrike, and SentinelOne. Network detection and response tooling and network traffic analysis. MITRE ATT&CK. Scripting and automation in Python or PowerShell. Windows, Linux, and cloud security telemetry, including authentication, process execution, and network log formats. Version control and ticketing workflows.","description_format":"text","description_chars":4008,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Security Operations","Stock Exchanges & Market Infrastructure"],"lifecycle":[{"event":"open","at":"2026-10-24T08:18:53Z"}],"visa":[],"liveness":{"score":3,"band":"cold","label":"Long shot","p_open":1,"p_active":0.112,"p_room":0.28,"age_days":47,"expected_fill_days":9,"reasons":["conf:3","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-26T05:57:25Z"},"pay":null,"html_url":"https://alion.io/job/intercontinental-exchange-cyber-security-engineer-threat-detection","json_url":"https://alion.io/job/intercontinental-exchange-cyber-security-engineer-threat-detection.json","meta":{"generated_at":"2026-10-26T06:20:55Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8493,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":58612},"rest":"https://alion.io/mcp/rest/get_company?id=58612"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fintercontinental-exchange-cyber-security-engineer-threat-detection"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fintercontinental-exchange-cyber-security-engineer-threat-detection"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fintercontinental-exchange-cyber-security-engineer-threat-detection"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/intercontinental-exchange-cyber-security-engineer-threat-detection\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fintercontinental-exchange-cyber-security-engineer-threat-detection"}]}