Senior Cloud Security Threat Detection Developer

Design threat detection at cloud scale.

At Coveo, we’re building advanced security engineering capabilities to protect our people, platforms, and customers. As a Senior Cloud Threat Detection Developer, you will design and implement detection strategies deeply integrated into our cloud environments. You’ll be part of the Security Engineering team, collaborating closely with Platform Engineering and our Security Operations Center to build scalable, automated, and resilient detection solutions.

This role combines deep cloud infrastructure expertise with threat detection engineering. You’ll help us reduce blind spots, validate our security posture, and empower teams across Coveo to stay ahead of emerging threats.

As our Senior Cloud Threat Detection Developer, you will:

• Build and maintain scalable detection capabilities leveraging AWS services.
• Collaborate with Platform Engineering to integrate detection and monitoring into AWS infrastructure lifecycle using Infrastructure-as-Code (Terraform, CloudFormation).
• Partner with the SOC team to tune detections, enrich alerts, and accelerate incident investigations.
• Implement and automate detections using existing platforms and services such as XSIAM, XSOAR, and AWS-native tools, ensuring consistency, maintainability, and efficient deployment.
• Act as a subject-matter expert in AWS security and cloud threat detection, mentoring peers and supporting engineering initiatives.

Here is what will qualify you for the role:

• 5+ years of experience in a similar role of threat detections related to security. 
• Expert-level knowledge of cloud infrastructure, including IAM policies, security services, networking, and observability.
• Proven experience building and tuning threat detections in SIEMs, SOARs and cloud-native logging.
• Strong proficiency in Python or another scripting language for automation and engineering.

What would make you stand out:

• Experience implementing detection pipelines with Infrastructure-as-Code (Terraform strongly preferred).
• Knowledge of Kubernetes/container detection and logging.
• Experience with purple-team or adversary emulation exercises to validate detections.
• Contributions to detection-as-code frameworks, open-source projects, or security research.

Do you think you can bring this role to life? 

You don’t need to check every single box; passion goes a long way and we appreciate that skillsets are transferable.

Send us your application, we want to get to know you! 

Join the Coveolife! 

We encourage all qualified candidates to apply regardless of, for example, age, gender, disability, gaps in CV, national or ethnic background. We know that applying for a new role is a lot of work and we really appreciate your time.