Senior Threat Detection & Emulation Engineer

If you’re interested in this role, please apply in English and include an English version of your CV.

Joining Moderna offers the unique opportunity to be part of a pioneering team that's revolutionizing medicine through mRNA technology, with a diverse pipeline of development programs across various diseases.

As an employee, you'll be part of a continually growing organization, working alongside exceptional colleagues and strategic partners worldwide, contributing to global health initiatives.

Moderna's commitment to advancing the technological frontier of mRNA medicines ensures a challenging and rewarding career experience, with the potential to make a significant impact on patients' lives worldwide.

Moderna is solidifying its presence within our international business services hub in Warsaw, Poland, a city renowned for its rich scientific and technological heritage. This hub provides critical functions, meeting the growing demand of Moderna’s global business operations. We’re inviting professionals from around the world to join our mission and contribute to the future of mRNA medicines.

As a Senior Threat Detection & Emulation Engineer, you’ll play a critical role in advancing Moderna’s global security operations by enhancing detection logic, executing adversary emulation, and elevating our defense capabilities across hybrid environments. You will bring advanced detection engineering, incident response, and automation skills to operationalize threat intelligence, simulate adversary behavior, and improve signal‑to‑noise ratios. Your work will enable rapid containment of emerging threats and drive forward Moderna’s digital defense posture in the biotech and life sciences sectors.

This is a highly technical, hands‑on role that operates at the intersection of blue team analytics and red team validation. You will collaborate closely with security operations, intelligence, IT engineering, and red team units, using your expertise to contribute directly to Moderna’s global cyber resilience.

• Developing, implementing, and continuously refining high‑fidelity detections in Splunk Enterprise Security (ES), Crowd Strike Falcon, and Microsoft Defender.

• Aligning detection logic to MITRE ATT&CK and real‑world adversary TTPs to ensure broad and deep coverage.

• Executing adversary emulation using frameworks such as Atomic Red Team, custom‑built simulations, and other red team tooling.

• Tuning detection pipelines to reduce false positives, while enhancing visibility and enrichment using contextual threat intelligence.

• Building and maintaining enrichment pipelines and automating correlation and triage through detection‑as‑code methodologies.

• Documenting detection gaps and coordinating with engineering teams to remediate coverage limitations.

• Establishing and measuring detection efficacy KPIs and response performance through custom reporting and dashboards.

• Developing and maintaining detection documentation, runbooks, and automated validation tests.

• Driving SOAR integrations to streamline containment and remediation workflows.

• Leading and supporting incident investigations through root cause analysis and collaboration with infrastructure and cloud teams.

• Driving purple‑team operations and enabling detection validation through controlled emulation exercises.

• Partnering with red teams and IT engineers to operationalize IOCs, TTPs, and threat intelligence into actionable detections.

• Monitoring emerging threats specific to the biotech/life sciences industries and ensuring proactive detection coverage.

• Supporting continuous improvement and maturity of Moderna’s detection and response posture across global operations.

• “We digitize everywhere possible using the power of code to maximize our impact on patients. This role lives at the frontier of automation, detection‑as‑code, and security engineering. Success here means building scalable, code‑driven detection logic and enrichment pipelines that enable speed, accuracy, and global impact.

• “We obsess over learning. We don’t have to…