Threat Detection Engineer IV

This job posting is anticipated to remain open for 30 days, from 03-Feb-2026. The posting may close early due to the volume of applicants.

Join a financial services firm where your contributions are valued. Edward Jones is a Fortune 500¹ company where people come first. With over 9 million clients and 20,000 financial advisors across the U.S. and Canada, we’re proud to be privately-owned, placing the focus on our clients rather than shareholder returns. Behind everything we do is our purpose:
We partner for positive impact to improve the lives of our clients and colleagues, and together, better our communities and society. We are an innovative, flexible, and inclusive organization that attracts, develops, and inspires performance excellence and a sense of belonging. People are at the center of our partnership. Edward Jones associates are seen, heard, respected, and supported. This is what we believe makes us the best place to start or build your career.

Overview

• A Threat Detection Engineer is a role focused on developing skills in adversary tradecraft research, detection development, and detection lifecycle management. Engineers at this level work within clearly defined scope and are supported through structured review, feedback, and mentorship.
• What You’ll Do

• Detection Engineers work on research and development tasks with scope defined by more senior engineers. Within that scope, they are expected to take full ownership of their work products, including research documentation, detection logic, and follow-up improvements.
• Detection Engineers are expected to author detection logic that will be deployed into production environments. All work is reviewed before deployment, but ownership of the work remains with the author.

Research and Documentation

• Detection Engineers are expected to conduct applied research on adversary techniques assigned to them and to produce detailed written documentation describing how those techniques operate at a technical level. This documentation should explain underlying mechanisms and execution flow with enough depth to support future detection work.
• Research assignments may cover a defined portion of a technique rather than an entire attack chain. Detection Engineers are expected to produce complete and correct documentation within the assigned scope.

Detection Development and Iteration

• Detection Engineers design, implement, and validate detections based on their research. They are responsible for tuning and improving detections they author, including investigating false positives, missed detections, and validation failures.
• Detection ownership is durable. Detection Engineers are expected to iterate on their work over time rather than handing it off when issues are identified. Guidance and feedback are provided, but responsibility for improvement remains with the author.

Validation and Feedback

• Detection Engineers participate in detection validation by engaging with the Threat Emulation team. This includes explaining researched techniques and detection approaches, reviewing validation results, and updating detections based on outcomes.
• Detection Engineers are expected to respond to operational feedback related to detections they own, including feedback from security operations and response teams. This feedback is treated as part of the normal detection lifecycle and a core learning mechanism.
• Decisions about validation strategy, test cadence, and broader detection health monitoring are handled by more senior Detection Engineers.

Coverage Reasoning

• Within the scope of their assigned work, Detection Engineers are expected to understand how detections map to adversary behavior and available telemetry. They should be able to articulate what activity is detectable, what is not, and why.
• Detection Engineers are not expected to own or maintain broader detection coverage models or prioritization decisions.

Collaboration and Communication

• Detection Engineers are expected to regularly present and explain their research and detection work to peers and partner teams. This includes participating in forums such as office hours and responding constructively to questions that surface gaps in…