Cybersecurity Threat Engineer - Remote

UNFI is seeking a Cybersecurity Threat Engineer to support the creation, tuning, and optimization of security detections that identify potential threats. The role assists with alert analysis, threat research, detection validation, security monitoring, SOAR playbook development, and automated response workflows while collaborating with multiple cybersecurity teams.

What you'll do:

• Develop, tune, and maintain threat detection use cases, correlation rules, and analytics across SIEM, EDR, and cloud security platforms
• Perform detection validation, gap analysis, and continuous optimization to improve detection coverage, reduce false positives, and enhance security monitoring effectiveness
• Partner with internal Threat Intelligence team to research emerging threats, adversary tactics, techniques, and procedures (TTPs), and translate intelligence into actionable detections aligned with the MITRE ATT&CK framework
• Participate in purple team exercises with offensive (red) and defensive (blue) teams to simulate real-world adversary TTPs, validate detection effectiveness, identify monitoring and response gaps, and support improvements to security controls and processes
• Design, develop, and maintain SOAR playbooks to automate incident response, threat enrichment, alert triage, and remediation workflows
• Build and maintain integrations between security technologies, cloud services, ticketing systems, and enterprise platforms using APIs and custom automation
• Develop scalable automation solutions that improve operational efficiency, reduce manual effort, and support end-to-end security operations processes
• Share learnings and contribute to SOC knowledge articles, job aids, and peer discussions on hunt methodology, adversary TTP analysis, detection tuning, and related techniques
• Collaborate with Threat Intelligence, Threat Emulation, GRC, Cybersecurity Architecture, Security Operations, and Engineering teams
• Stay current with industry trends through research, training, certifications, knowledge sharing, and conferences where applicable
• Support threat assessment and modeling activities by documenting threats and contributing to resiliency initiatives that require broader non-SOC business partner awareness
• Support security tooling assessments as assigned

What they're looking for:

• 0-3 years of professional experience in cybersecurity, security operations, infrastructure, systems administration, networking, software engineering, or related technology fields
• 0-3 years of experience or demonstrated exposure to threat monitoring, threat hunting, threat intelligence, incident response, vulnerability management, or security operations
• 0-3 years of working experience with Powershell, Python or other object-oriented scripting languages
• Comfortable interacting with APIs and performing data transformation, enrichment, and analysis to support business and security objectives
• Working knowledge of Windows and Linux/Unix platforms
• Able to manage assigned work, follow priorities, and escalate when timelines or risks require attention
• Strong written and verbal communication skills. Communicates clearly, accurately, and in a timely manner, adapting technical information for technical and non-technical audiences with guidance as needed
• Collaborative and respectful of diverse people, thinking, and styles
• Familiarity with testing, validating, or documenting detection rules in SIEM platforms
• Foundational understanding of MITRE ATT&CK, Cyber Kill Chain, Pyramid of Pain, and Detection as code principles
• Foundational understanding of cloud infrastructure and cloud security
• Foundational understanding of software development tools and methodologies, ex. SDLC, Version Control (Git)

Benefits:

• For Washington positions (or positions that may be performed remotely from Washington), Washington-specific paid time off details apply.
• Paid Time Off
• Sick Time
• Paid holidays
• Parental leave
• 401K Program
• Medical insurance
• Dental insurance
• Vision insurance
• Life insurance