The Threat Detection Engineer role involves analyzing SaaS security data, investigating incidents, developing detection strategies, and enhancing alert accuracy by minimizing false positives, while staying informed on cybersecurity trends.
Description
Reco is a fast-growing SaaS security company that helps organizations secure their SaaS and AI environments by detecting identity-based threats and risky configurations.
We are looking for a Threat Detection Engineer to analyze large-scale SaaS security data, investigate incidents, and develop advanced threat detection strategies.
You will work closely with security researchers and customers to identify emerging threats and improve detection capabilities across SaaS environments.
Responsibilities- Threat Analysis and Research: Dive deep into terabytes of SaaS Application data to identify new attack vectors, emerging threats, and vulnerabilities across various attack surfaces.
- Stay up-to-date with the latest cybersecurity trends and contribute to the development of cutting-edge threat detection methodologies.
- Incident Investigation: Utilize your technical prowess to investigate complex SaaS & AI security incidents, analyzing data from diverse SaaS applications to uncover the root causes and methods of attack.
- False Positive Reduction: Leverage your expertise in data analysis and correlation to fine-tune detection rules and algorithms, minimizing false positives and enhancing the accuracy of our platform's threat alerts.
- Thought Leadership and Community Engagement: Drive thought leadership initiatives by creating technical blog posts, delivering webinars, and speaking at conferences to share insights, educate the community, and enhance the company's reputation in the cybersecurity landscape.
- Be at the forefront of the Reco mission and work closely with Reco customers regarding cyber security investigations and incidents detected in their environments
- Collaborate with security researchers and data scientists to define new threat detection strategies based on SaaS attack vectors and industry trends.
- Continuously monitor and analyze SaaS attack techniques, adapting security posture to evolving threats.
- Work with APIs and integrations to ingest security logs from various SaaS platforms, correlating signals to detect real threats.
- A background of at least 5 years in cybersecurity, preferably in SOC, SIEM, Threat Intelligence, or Cloud Security
- Experience with SaaS security challenges, such as shadow IT, OAuth risks, IDP misconfigurations, and excessive permissions.
- Hands-on experience with security data analysis, including large-scale log processing, anomaly detection, and behavioral analytics.
- Proficiency in SQL (e.g., ClickHouse) for querying security events and correlating threat indicators.
- Strong understanding of identity-based attacks, insider threats, and SOC detection methodologies.
- Familiarity with SIEM and XDR solutions (e.g., Splunk, Sentinel, Chronicle) and their role in modern detection engineering.
- Strong problem-solving and analytical skills to triage security incidents and optimize detection rules.
Advantages:
- Familiarity with SaaS security best practices, including least-privilege access, OAuth governance, and SSPM.
- Knowledge of SaaS security frameworks (e.g., SSPM, CASB).
- Experience with IDP security (Okta, Azure AD, Google IAM) and detecting identity-related SaaS threats.
- Hands-on experience with Threat Hunting and / or Detection engineering in SaaS environments.
- Understanding of SaaS API security and experience analyzing integrations with third-party applications.
Similar Jobs
Security • Cybersecurity
The Threat Detection Engineer will evaluate and support the Threat Analysis environment, analyze needs for internal tools, and assist in researching threats such as malware and vulnerabilities.
Top Skills:
DockerElasticsearchKubernetesKvmLuaMolochMongoDBPostgresPythonSnortSuricataTcpdumpVirtualboxVMwareWireshark
Security • Cybersecurity
As a Cyber Threat Detection & Response Engineer, you'll perform threat hunts, create detection rules, analyze logs, collaborate with teams, and mentor juniors.
Top Skills:
CrowdstrikeEdr/XdrElasticMitre Att&CkPowershellPythonSentineloneSiems
Mobile • Security • Software • Cybersecurity
Design and maintain datasets, build and evaluate domain-specific ML and vision-language models for real-time privileged access threat detection; deploy and optimize Python/Docker inference services integrated with WebSocket/WebRTC and protocol-level interfaces; monitor and document production models.
Top Skills:
AWSAws BedrockAzureClaudeDatabase ProtocolsDockerGCPGeminiGitGptGraph Data StructuresHugging FaceLlm FrameworksPythonQwenRdpSshVision-Language ModelsVncWebrtcWebsocket
What you need to know about the Los Angeles Tech Scene
Los Angeles is a global leader in entertainment, so it’s no surprise that many of the biggest players in streaming, digital media and game development call the city home. But the city boasts plenty of non-entertainment innovation as well, with tech companies spanning verticals like AI, fintech, e-commerce and biotech. With major universities like Caltech, UCLA, USC and the nearby UC Irvine, the city has a steady supply of top-flight tech and engineering talent — not counting the graduates flocking to Los Angeles from across the world to enjoy its beaches, culture and year-round temperate climate.
Key Facts About Los Angeles Tech
- Number of Tech Workers: 375,800; 5.5% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Snap, Netflix, SpaceX, Disney, Google
- Key Industries: Artificial intelligence, adtech, media, software, game development
- Funding Landscape: $11.6 billion in venture capital funding in 2024 (Pitchbook)
- Notable Investors: Strong Ventures, Fifth Wall, Upfront Ventures, Mucker Capital, Kittyhawk Ventures
- Research Centers and Universities: California Institute of Technology, UCLA, University of Southern California, UC Irvine, Pepperdine, California Institute for Immunology and Immunotherapy, Center for Quantum Science and Engineering
