{"id":3483966,"url":"https://alion.io/job/true-anomaly-threat-detection-response-engineer-iii","title":"Threat Detection & Response Engineer III","company":{"id":3381,"name":"True Anomaly","domain":"trueanomaly.space","url":"https://alion.io/company/true-anomaly","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":92,"open_postings":174,"ghost_share":0.046,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":90,"computed_at":"2026-11-02T06:13:15Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"contractor","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Long Beach, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":120000,"max":165000,"currency":"USD","period":"year","gross":null,"usd_annual":165000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Bash","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"Linux","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Windows","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"CI/CD","optional":true},{"name":"CMMC","optional":true},{"name":"FedRAMP","optional":true},{"name":"GCP","optional":true},{"name":"GitOps","optional":true},{"name":"NIST 800-53","optional":true},{"name":"Red Teaming","optional":true}],"status":"live","first_seen_at":"2026-10-29T16:19:39Z","employer_posted_date":"2026-10-29","last_verified_at":"2026-11-02T12:55:00Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":3},"description":"Space is a warfighting domain. True Anomaly seeks those with the talent and ambition to build the technology that secures it.\nOUR MISSION\nTrue Anomaly delivers decisive capabilities for space superiority. We build autonomous spacecraft, advanced payloads, mission software, and space-based interceptors - enabling the U.S. and its Allies to secure the space environment and counter threats from the ultimate high ground.\nOUR VALUES\nBe the offset. We create asymmetric advantages with creativity and ingenuity.\nWhat would it take? We challenge assumptions to deliver ambitious results.\nIt’s the people. Our team is our competitive advantage and we are better together.\nBENEFITS & PERKS*\nBest-in-class healthcare: 100% company-paid medical, dental, and vision coverage for you and your dependents, with HSA/HRA options\n Generous time off: Flexible Time Off (FTO) for exempt employees, accrued PTO of up to 25 days for non-exempt employees, plus 12 paid holidays; Parental Leave; Sick Leave\nFuel for your day: Daily catered lunch and unlimited snacks for in-office employees\n And more: 401(k) retirement plan, fitness reimbursement, and Dog Fridays\n Equity participation: Equity is included as part of our total compensation package, giving you an opportunity to share in the company’s success.\n*Do not apply to fixed term and temporary roles\nYOUR MISSION\nAs a Threat Detection & Response Engineer III, you will be an integral part of our threat detection and response function, helping build and mature the detection capabilities, response processes, and security tooling that underpin our security operations program.\nYou'll design and implement detection capabilities, sharpen our incident response procedures, and contribute to the foundation of a world-class security program. Expect a fast-paced environment where your work carries real weight and directly influences our security posture.\nThis role is a great fit for someone who takes initiative, enjoys digging into hard problems, and wants to make a tangible impact on a growing security program.\nThis position requires an active security clearance.\nResponsibilities\nDevelop incident response plans, playbooks, and SOPs; build scalable processes to support future team growth\nDesign and implement custom security detections across corporate and cloud environments, leveraging frameworks like MITRE ATT&CK\nContinuously tune detection rules and develop threat models to improve fidelity and address coverage gaps\nMonitor, triage, and respond to security alerts across multiple platforms and data sources\nPerform incident investigations through technical analysis, containment, eradication, and recovery; document findings and lessons learned\nProactively hunt for threats and leverage threat intelligence to anticipate emerging adversary TTPs\nAdminister and optimize EDR and SIEM platforms; integrate log sources to enhance visibility and correlation\nBuild automation and orchestration workflows to improve response efficiency\nPartner with cross-functional teams (IT, Engineering, Legal, Compliance) and communicate technical findings to diverse stakeholders\nQUALIFICATIONS\nA good candidate will have:\nActive Secret/TS security clearance and ability to maintain a security clearance\n3+ years of experience in cybersecurity, with at least 2 years focused on security operations, detection engineering, incident response, or threat hunting\nExperience in building or tuning security detections\nFamiliarity with risk-based alerting and alert tuning, including strategies to reduce noise, improve detection fidelity, and prioritize high-signal alerts\nFamiliarity with EDR platforms, including basic alert triage and response actions\nWorking knowledge of Windows, MacOS, or Linux endpoint security and common attack techniques\nFamiliarity with SIEM platforms and log analysis (e.g., Splunk, Elastic, or similar)\nBasic understanding of common attack vectors, TTPs, and security frameworks such as MITRE ATT&CK and the Cyber Kill Chain\nExperience with scripting (Python, PowerShell, or Bash) for automation or analysis tasks\nClear verbal and written communication skills\nPREFERRED QUALIFICATIONS\nAn ideal candidate will also have:\nKnowledge of digital forensics and malware analysis techniques\nExperience building or significantly maturing a detection and response program\nExperience working in Azure Government Cloud (Azure GovCloud) environments\nExperience with cloud security monitoring in AWS, GCP, or Azure commercial environments\nFamiliarity with CMMC, FedRAMP, NIST 800-53, or other federal compliance frameworks\nExperience with Detections-as-Code paradigms, GitOps, CI/CD, etc\nExperience participating in or supporting red team/purple team exercises\nWORK ENVIRONMENT\nThis role must be onsite in ourLong Beach office #LIOnsite\nThis role operates in a fast-paced, high-stakes environment where rapid decision-making and adaptability are essential \nOn-call rotation participation, including after-hours participation, is required for incident response coverage\nMust be comfortable working under pressure during active security incidents\nHigh degree of autonomy and ownership\nDirect access to leadership and opportunity to influence security strategy\nWHAT WE OFFER\nCompetitive salary\nOpportunity to work on challenging, mission-critical security initiatives\nProfessional development and certification support\nCollaborative culture with experienced security professionals\nEquity + Benefits including Health, Dental, Vision, HRA/HSA options, PTO and paid holidays, 401K, Parental Leave \nCOMPENSATION\nBase Salary: Long Beach - $120,000 - $165,000\n Equity + Benefits including Health, Dental, Vision, HRA/HSA options, PTO and paid holidays, 401K, Parental Leave \nYour actual level and base salary will be determined on a case-by-case basis and may vary based on the following considerations: job-related knowledge and skills, education, location, and experience. \nThis position will be open until it is successfully filled. To submit your application, please follow the directions below.\nTo conform to U.S. Government space technology export regulations, including the International Traffic in Arms Regulations (ITAR) you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.\nTrue Anomaly is committed to equal employment opportunity on any basis protected by applicable state and federal laws. If you have a disability or additional need that requires accommodation, please do not hesitate to let us.\nTo conform to U.S. Government space technology export regulations, including the International Traffic in Arms Regulations (ITAR) you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.\nTrue Anomaly is committed to equal employment opportunity on any basis protected by applicable state and federal laws. If you have a disability or additional need that requires accommodation, please do not hesitate to let us know.\nTo protect candidates and our company from application fraud and impersonation, we use third-party tools to verify applicant identity and detect fraudulent applications. Learn more in our Privacy Notice.","description_format":"text","description_chars":7372,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":true,"languages":[]},"benefits":["401k plan","Equity","Flexible time off","Parental leave","Professional development","Retirement plans"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","Satellite Manufacturing","Space Services","Space Defense"],"lifecycle":[{"event":"open","at":"2026-10-29T21:04:11Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":3,"expected_fill_days":90,"reasons":["conf:1","velocity","win:early","comp:brand"],"computed_at":"2026-11-02T06:13:15Z"},"pay":{"stated_usd_annual":165000,"is_top_pay":true},"html_url":"https://alion.io/job/true-anomaly-threat-detection-response-engineer-iii","json_url":"https://alion.io/job/true-anomaly-threat-detection-response-engineer-iii.json","meta":{"generated_at":"2026-11-02T16:13:00Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":22614,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3381},"rest":"https://alion.io/mcp/rest/get_company?id=3381"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftrue-anomaly-threat-detection-response-engineer-iii"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftrue-anomaly-threat-detection-response-engineer-iii"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftrue-anomaly-threat-detection-response-engineer-iii"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/true-anomaly-threat-detection-response-engineer-iii\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftrue-anomaly-threat-detection-response-engineer-iii"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3483966}},{"tool":"search_jobs","arguments":{"company":"trueanomaly.space","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3483966},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}