Detection Engineering Analyst

Why Join AspenView?

At AspenView, we’re more than a nearshore IT partner—we’re a people-first, purpose-driven company that believes great culture drives great outcomes. We’re passionate about connecting talent and technology to deliver measurable value for clients—and meaningful career paths for our people.

Here’s what you can expect:

• Competitive base
• Flexible work model: hybrid, remote, or in-office
• Real growth opportunities and leadership visibility
• Inclusive, respectful culture that blends U.S. innovation with Colombian heart
• A company that listens, invests in you, and celebrates wins together

The Detection Engineering Analyst is a hands-on professional responsible for writing, testing and tuning the detections that decide which security events become alerts for a 24/7 SOC serving a large US consumer lender. Based in Bogotá or Buenos Aires, in a hybrid model, you will work across telemetry from CrowdStrike, Microsoft Defender, Okta, Palo Alto, Proofpoint and AWS flowing through Abstract Security into Elastic. You will report to the Detection Engineering Lead, who reviews every rule before it goes to the client for approval. This role suits someone who has spent two or more years writing their own rules on any SIEM and keeps asking why an alert fired, or why it didn’t.

What you will do:

Detection Development

• Write new detection rules and tune existing ones, working from a backlog you help your lead prioritize.
• Test rules against sample data and simulated attacks before release, and document what each one is meant to catch.
• Maintain the detection repository and its MITRE ATT&CK mapping.

Tuning & Data Quality

• Work the noisy-rule list with Tier 2: prove a rule is too broad, fix it, and show that the false-positive rate dropped.
• Check data sources (CrowdStrike, Defender, Okta, Palo Alto, Proofpoint, AWS) so fields parse correctly, timestamps align and events reach Elastic.

Collaboration & Continuous Improvement

• Turn threat hunting findings and Tier 2 feedback into new rules.
• Work alongside the threat hunters, turning good hunts into production detections.
• Support major incidents when needed by writing emergency detections or helping the analysts.

Tools & Technologies:

• SIEM & Detection: Elastic Security (EQL, ES|QL, KQL); Google SecOps, Splunk, QRadar or Sentinel experience also relevant.
• Data Pipeline: Abstract Security, or equivalents such as Cribl, Logstash or Beats.
• Endpoint, Identity & Cloud: CrowdStrike Falcon, Microsoft Defender, Okta, AWS CloudTrail and GuardDuty.
• Engineering: Git, Python or PowerShell, and MITRE ATT&CK.
• Testing & Automation (Bonus): Sigma, Atomic Red Team or other attack simulation tools.

What you bring:

• Experience: 2+ years writing and tuning your own detection rules in production, on any SIEM (Google SecOps, Splunk, QRadar, Sentinel, Elastic or equivalent).
• Technical Depth: Fluency in that SIEM’s query or rule language (SPL, AQL, KQL, YARA-L, EQL or equivalent); the logic transfers to Elastic, which you’ll learn here. Understanding of how common attacks show up in endpoint, identity and cloud logs, mapped to MITRE ATT&CK.
• Engineering Practice: Git or scripted automation (Python, PowerShell or similar) in your current work. Detection as code is taught on the job.
• Communication: English at B1 or above, strong enough to write change records and discuss rule logic with the client’s security team.
• Mindset: Curious and evidence-driven. You want to know why a rule fires or misses, and you follow security rules and change control consistently.
• Availability: Full-time, as a direct AspenView employee dedicated to one client, in a hybrid model based in Bogotá or Buenos Aires: two days a week in AspenView’s office and three from home, plus in-person attendance for important meetings. US Eastern business hours, with no shift rotation. The client’s systems are accessed only through its VDI, and access requires identity, criminal background, employment and education checks, repeated periodically.
• Bonus Qualifications: Hands-on Elastic Security; detection as code already in practice (rules in Git, tests in a pipeline); Sigma rules or attack simulation; a SOC Tier 1 or Tier 2 background; log pipelines such as Logstash, Beats, Cribl or Abstract Security; CrowdStrike, Microsoft Defender or Okta telemetry; AWS logging (CloudTrail, GuardDuty); and SC-200, CySA+, BTL1 or Elastic certifications.

Growth: The natural progression is toward detection engineering lead work, or across to threat hunting.