{"id":1353882,"url":"https://alion.io/job/the-hartford-sr-security-engineer-cloud-threat-detection","title":"Sr. Security Engineer - Cloud Threat Detection","company":{"id":1760358,"name":"The Hartford","domain":"thehartford.com","url":"https://alion.io/company/thehartford-com","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":82,"open_postings":30,"ghost_share":0,"stale_share":0.733,"repost_share":0,"time_to_fill_p50_days":27,"computed_at":"2026-10-25T05:49:26Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Hartford, United States","Charlotte, United States","Columbus, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":128400,"max":192600,"currency":"USD","period":"year","gross":null,"usd_annual":192600},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Cortex","optional":false},{"name":"Crowdstrike","optional":false},{"name":"GCP","optional":false},{"name":"IAM","optional":false},{"name":"IBM QRadar","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Wiz","optional":false},{"name":"Cyber Kill Chain","optional":true},{"name":"Microsoft Defender","optional":true},{"name":"PowerShell","optional":true},{"name":"Prometheus","optional":true},{"name":"Python","optional":true},{"name":"SentinelOne","optional":true},{"name":"Threat Modeling","optional":true}],"status":"live","first_seen_at":"2026-08-13T00:00:00Z","employer_posted_date":"2026-08-13","last_verified_at":"2026-10-23T14:48:26Z","board_verified":false,"closed_at":null,"days_open":74,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":74},"description":"Senior Security Engineer - IS07FEWe’re determined to make a difference and are proud to be an insurance company that goes well beyond coverages and policies. Working here means having every opportunity to achieve your goals - and to help others accomplish theirs, too. Join our team as we help shape the future.\nThe Hartford's Information Protection (THIP) organization is seeking a Sr. Security Engineer, Cloud Threat Detection Engineer to design and enhance enterprise-scale cloud threat detection capabilities across AWS and Google Cloud Platform (GCP). This role will develop high-fidelity detections, integrate cloud telemetry into Splunk (RBA) and the enterprise SIEM, and improve visibility into cloud-based threats. The ideal candidate has hands-on experience with AWS GuardDuty, AWS CloudTrail, Google Security Command Center (SCC), Cloud Logging, and other cloud-native security tools, partnering closely with Cloud Operations, Incident Response, Detection Engineering, and SOC teams to strengthen cloud security monitoring and response.\nThis role will have a Hybrid work schedule, with the expectation of working in an office (Columbus, OH, Chicago, IL, Hartford, CT or Charlotte, NC) 3 days a week (Tuesday - Thursday).\nResponsibilities\nDesign, develop, test, and deploy detection content focused on AWS and GCP threats and suspicious activity.\nIntegrate and normalize cloud security telemetry from AWS and GCP into the enterprise SIEM platform.\nDevelop detections leveraging data sources including: AWS GuardDuty\nAWS CloudTrail\nAWS VPC Flow Logs\nAWS Config\nGoogle Security Command Center (SCC)\nGoogle Cloud Audit Logs\nGoogle Cloud Logging\nIdentity and Access Management (IAM) telemetry\nOther 3rdparty CSMPs(Orca, CrowdStrike, Wiz)\n\nCreate and maintain SIEM detections, analytics, risk-based detections, dashboards, assets, identities, and alerting content.\nContinuously tune and optimize detection logic to reduce false positives while improving detection fidelity and coverage.\nMap detections to MITRE ATT&CK and cloud-specific attack techniques.\nParticipate in adversary emulation, purple team exercises, and cloud attack simulations to validate detection effectiveness.\nDevelop detection requirements and enrichment strategies to support AI/SOAR automation and incident response workflows.\nCreate and maintain Standard Operating Procedures (SOPs), runbooks, and investigation guides for cloud-based detections and alerts.\nTrain and mentor L1 and L2 SOC analysts on: Cloud attack techniques and tactics\nUse of cloud-native security tooling\nInvestigation workflows in the SIEM\nCloudTrail and GCP Audit Log analysis\nPivoting from SIEM alerts to AWS and GCP consoles for validation and triage\n\nProvide advanced escalation support to the SOC and Incident Response teams during cloud security investigations.\nParticipate in on-call support rotations (approximately 5 weeks annually).\nRequired Qualifications\n5+ years of cybersecurity experience with direct involvement in security operations, incident response, threat detection, or detection engineering.\nHands-on operational experience securing both AWS and Google Cloud Platform (GCP) environments.\nStrong knowledge of AWS security services and GCP security services.\nExperience developing and tuning enterprise SIEM detections using cloud telemetry.\nExperience integrating cloud-native security tools and log sources into enterprise security monitoring platforms such as Splunk Enterprise Security, Microsoft Sentinel, QRadar, Cortex XSIAM, etc.\nStrong understanding of cloud attack methodologies, identity compromise, privilege escalation, persistence, lateral movement, and data exfiltration techniques.\nExperience investigating alerts using raw cloud telemetry, including CloudTrail and GCP Audit Logs.\nAbility to create operational documentation, investigation guides, SOPs, and analyst playbooks.\nExperience training and mentoring SOC analysts on cloud threat investigation and triage processes.\nStrong written and verbal communication skills.\nPreferred Qualifications\nDemonstrated experience with Splunk Enterprise Security, SPL, data modeling, Risk-Based Alerting (RBA), dashboard creation, etc.\nStrong understanding of adversary behavior, MITRE ATT&CK, cyber kill chain, and threat modeling.\nExperience with SOAR platforms and security automation workflows.\nScripting and automation experience using Python, PowerShell, or Bash.\nExperience supporting multi-cloud security programs.\nHands-on threat hunting experience in cloud environments.\nExposure to EDR platforms such as CrowdStrike, SentinelOne, or Microsoft Defender XDR for Endpoint\nPreferred Certifications\nAWS Certified Security - Specialty\nGoogle Professional Cloud Security Engineer\nGIAC Cloud Threat Detection (GCTD)\nGIAC Certified Incident Handler (GCIH)\nGIAC Cyber Threat Intelligence (GCTI)\nSplunk Certified Architect or Consultant\nCandidate must be authorized to work in the US without company sponsorship. The company will not support the STEM OPT I-983 Training Plan endorsement for this position.\nCompensation\nThe listed annualized base pay range is primarily based on analysis of similar positions in the external market. Actual base pay could vary and may be above or below the listed range based on factors including but not limited to performance, proficiency and demonstration of competencies required for the role. The base pay is just one component of The Hartford’s total compensation package for employees. Other rewards may include short-term or annual bonuses, long-term incentives, and on-the-spot recognition. The annualized base pay range for this role is:\n$128,400 - $192,600Equal Opportunity Employer/Sex/Race/Color/Veterans/Disability/SexualOrientation/Gender Identity or Expression/Religion/Age\nAbout Us | Our Culture | What It’s Like to Work Here | Perks & Benefits","description_format":"text","description_chars":5824,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Annual bonuses","Hybrid work"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","Property & Casualty Insurance","Health Insurance & Benefits"],"lifecycle":[{"event":"open","at":"2026-09-27T21:19:15Z"}],"visa":[],"liveness":{"score":12,"band":"cold","label":"Long shot","p_open":1,"p_active":0.445,"p_room":0.28,"age_days":73,"expected_fill_days":27,"reasons":["conf:39","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-25T05:49:26Z"},"pay":{"stated_usd_annual":192600,"is_top_pay":true},"html_url":"https://alion.io/job/the-hartford-sr-security-engineer-cloud-threat-detection","json_url":"https://alion.io/job/the-hartford-sr-security-engineer-cloud-threat-detection.json","meta":{"generated_at":"2026-10-26T05:51:20Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":7855,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1760358},"rest":"https://alion.io/mcp/rest/get_company?id=1760358"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fthe-hartford-sr-security-engineer-cloud-threat-detection"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fthe-hartford-sr-security-engineer-cloud-threat-detection"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fthe-hartford-sr-security-engineer-cloud-threat-detection"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/the-hartford-sr-security-engineer-cloud-threat-detection\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fthe-hartford-sr-security-engineer-cloud-threat-detection"}]}