Security Engineer at Galaxy

The Security Engineer will develop, test, and tune detection rules, signatures, and alerts across SIEM, EDR, IDS/IPS, and other monitoring platforms, continuously optimizing existing logic to reduce false positives and improve detection accuracy. They will create advanced queries, dashboards, and hunting content to proactively identify anomalous activity, and collaborate with SOC analysts to validate findings and enrich detection capabilities. This role involves providing content and playbooks to accelerate incident triage and response, automating repeatable SOC processes and workflows using SOAR platforms, and leveraging internal and external threat intelligence to inform detection engineering. The engineer will develop indicators and rules to detect tactics, techniques, and procedures (TTPs) mapped to the MITRE ATT&CK framework, and partner with SOC analysts, threat hunters, and red teams to ensure detection coverage for key attack vectors. Additionally, they will document and maintain detection content, response playbooks, and knowledge bases.