Threat Detection Engineer IV

Overview

Innovate here. And see your ideas come to life.

It's an exciting time to work in tech at Edward Jones. We are making massive investments in emerging technologies to improve how we work with our clients and with each other. Relationships are the focus of our business model. And working in Technology here means using your skills to build, deliver and maintain the technologies that enable us to deepen and support those relationships.

The best part? We develop and create our own industry-leading solutions internally. And you can be a part of it. Working with emerging new technologies. Creating platforms, programs and experiences that change how we work together - and support our client-first focus. Changing the future of our firm, the industry and the advisor-client relationship.

Job Overview

Position

Schedule:

Full-Time

This job posting is anticipated to remain open for 30 days, from 03-Feb-2026. The posting may close early due to the volume of applicants.

Overview

A Threat Detection Engineer is a role focused on developing skills in adversary tradecraft research, detection development, and detection lifecycle management. Engineers at this level work within clearly defined scope and are supported through structured review, feedback, and mentorship.

• Scope and Ownership
  Detection Engineers work on research and development tasks with scope defined by more senior engineers. Within that scope, they are expected to take full ownership of their work products, including research documentation, detection logic, and follow-up improvements.

• Detection Engineers are expected to author detection logic that will be deployed into production environments. All work is reviewed before deployment, but ownership of the work remains with the author.

• Research and Documentation
  Detection Engineers are expected to conduct applied research on adversary techniques assigned to them and to produce detailed written documentation describing how those techniques operate at a technical level. This documentation is expected to explain underlying mechanisms and execution flow with enough depth to support future detection work.

• Research assignments may cover a defined portion of a technique rather than an entire attack chain. Detection Engineers are expected to produce complete and correct documentation within the assigned scope.

• Detection Development and Iteration
  Detection Engineers design, implement, and validate detections based on their research. They are responsible for tuning and improving detections they author, including investigating false positives, missed detections, and validation failures.

• Detection ownership is durable. Detection Engineers are expected to iterate on their work over time rather than handing it off when issues are identified. Guidance and feedback are provided, but responsibility for improvement remains with the author.

• Validation and Feedback
  Detection Engineers participate in detection validation by engaging with the Threat Emulation team. This includes explaining researched techniques and detection approaches, reviewing validation results, and updating detections based on outcomes.

• Detection Engineers are expected to respond to operational feedback related to detections they own, including feedback from security operations and response teams. This feedback is treated as part of the normal detection lifecycle and a core learning mechanism.

• Decisions about validation strategy, test cadence, and broader detection health monitoring are handled by more senior Detection Engineers.

• Coverage Reasoning
  Within the scope of their assigned work, Detection Engineers are expected to understand how detections map to adversary behavior and available telemetry. They should be able to articulate what activity is detectable, what is not, and why.

• Detection Engineers are not expected to own or maintain broader detection coverage models or prioritization decisions.

• Collaboration and Communication
  Detection Engineers are expected to regularly present and explain their research and detection work to peers and partner teams. This includes participating in forums such as office hours and responding constructively to questions that surface gaps in understanding.

• Detection Engineers interact with partner teams primarily to explain their research and detection work. They are not expected to independently drive cross-team processes or follow-up actions. When issues arise that require coordination beyond explanation or learning, Detection Engineers escalate to more experienced team members.

• Detection Engineers participate in peer review as part of their development. This includes reviewing research and detection work authored by others under guidance, and applying feedback received during review to their own work. Peer review is treated as a learning activity rather than a gatekeeping function.

Edward Jones' compensation and benefits package includes medical and prescription drug, dental, vision, voluntary benefits (such as accident, hospital…