About the Role
We're looking for a Defensive Security Consultant to help clients improve how they detect, investigate, and respond to adversary activity. You'll combine hands-on detection engineering with practical guidance, working alongside Crimson7's offensive and defensive practitioners to make security capabilities more effective in real environments.
Responsibilities
- Assess client detection and response capabilities, then help define practical improvements
- Develop and tune detection rules and hunting queries for SIEM and EDR platforms
- Validate detections against realistic attack simulations and relevant adversary techniques
- Work with red team operators, SOC teams, and client stakeholders to investigate coverage gaps
- Support detection-as-code practices and help clients operationalize improvements
- Explain findings and recommendations clearly to technical teams and decision-makers
Requirements
- Experience in detection engineering, threat hunting, incident response, or security operations
- Hands-on experience with at least one SIEM or EDR platform, such as Microsoft Sentinel, Splunk, or Elastic
- Experience writing or tuning detection logic and investigation queries, such as Sigma, KQL, or SPL
- Understanding of common attack techniques and the MITRE ATT&CK framework
- Familiarity with endpoint, identity, network, or cloud telemetry
- Strong communication skills and a practical, collaborative approach to client work
Nice to Have
- Experience with detection-as-code or CI/CD workflows for security content
- Purple team, threat hunting, or incident response experience
- Scripting skills in Python or PowerShell
- Experience with cloud security telemetry or identity environments
- Offensive security background
What We Offer
- Work across offensive and defensive security engagements
- Collaborate with red team operators and client security teams
- Competitive salary and benefits
- Flexible working arrangements
- Continuous learning and development opportunities