A Senior Threat Engineer builds and improves systems, logic, and workflows that allow Coalition’s Wirespeed Verdict Engine to make high-precision security decisions at scale
Disclaimer: This is not a traditional SOC analyst role
Success in this position is not defined by working one alert at a time, but by figuring out how to handle thousands of similar situations better, faster, and more consistently through automation, patterning, and engineering. Key focus will be studying how investigations should work, identifying repeatable decision points, and turning that thinking into detections, enrichment, triage logic, and automated response workflows
As a senior member of the team, you'll be expected to take ownership of complex problem areas, exercise strong judgment in ambiguous situations, and help shape how the broader Threat Engineering function operates. This role is for someone who can bridge threat detection, engineering, and customer experience. Its ideal for someone who is more interesting asking, “How should this entire class of problem be solved?” rather than, “How do I close the next alert in the queue?”
If you are excited by designing systems that scale expert judgment, improving both customer outcomes and operational efficiency, and doing work that looks very different from a conventional analyst job, this role is for you
Design, build, and improve the detection, decisioning, and response workflows that power the Wirespeed Verdict Engine
Own complex threat detection and workflow problem spaces from investigation concept through implementation, validation, and iteration
Translate investigative thinking and threat research into scalable detections, enrichment, triage logic, and automated decisions that improve speed, accuracy, reliability, and customer outcomes
Analyze operational data to identify false positives, false negatives, latency issues, and opportunities to improve how entire categories of work are handled
Continuously raise the ceiling of what the system can do autonomously, reducing manual review while improving service quality and consistency
Support especially complex or novel cases when needed, then feed those lessons back into the system so similar situations can be handled better in the future
Keep the customer experience front and center by ensuring Wirespeed outputs are clear, helpful, accurate, and appropriately calibrated to the customer’s situation
Identify patterns in customer pain, confusion, or friction and use those insights to improve verdict logic, response content, and overall product behavior
Partner closely with product, engineering, and security teams to improve platform capabilities, data quality, and operational leverage
Help define best practices, operating principles, and technical standards for Threat Engineering work
Document detection concepts, workflow logic, and operating principles so the team can scale knowledge
Provide technical leadership through strong execution, sound judgment, and mentorship of less experienced teammates