Threat Detection Principal Engineer

About this role:

Wells Fargo is seeking a Principal Engineer in Technology as part of Cybersecurity. Learn more about the career areas and lines of business at wellsfargojobs.com.

Wells Fargo is seeking a Principal Threat Detection Engineer to join our Cybersecurity team. This role will serve as the senior technical authority for threat detection engineering, with a focus on leveraging Splunk, CrowdStrike, and Microsoft Defender to identify and mitigate advanced threats. The ideal candidate will possess deep expertise in MITRE ATT&CK, threat actor TTPs, and modern detection engineering practices.

In this role, you will:

• Act as a trusted advisor to leadership on threat detection strategy and platform architecture.
• Lead resolution of complex detection engineering challenges across multiple security platforms.
• Translate threat intelligence and business risk into actionable detection use cases.
• Maintain deep knowledge of adversary tradecraft, detection methodologies, and security analytics.
• Drive innovation and continuous improvement across threat detection operations.

• Serve as the Principal Engineer (SME) for threat detection across Splunk, CrowdStrike, and Microsoft Defender platforms.
• Lead the design and implementation of scalable detection logic and alerting frameworks aligned to MITRE ATT&CK techniques.
• Develop and maintain threat detection content to identify adversarial behaviors and emerging TTPs.
• Collaborate with threat intelligence, incident response, and SOC teams to ensure detection coverage and response readiness.
• Drive automation and enrichment of detection pipelines using scripting and orchestration tools.
• Provide technical oversight and mentorship to detection engineering teams.
• Evaluate emerging threats and technologies to continuously improve detection capabilities.
• Interface with executive leadership to align detection strategy with business priorities and risk posture.

• 7+ years of Engineering experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education
• + years of hands-on experience with Splunk, including SPL development and detection engineering.
• 3+ years of experience with CrowdStrike Falcon and Microsoft Defender for Endpoint.
• Deep understanding of MITRE ATT&CK framework and threat actor TTPs.
• Proven experience developing and tuning detection content in large-scale enterprise environments.
• Strong scripting skills (e.g., Python, PowerShell) and familiarity with automation tools.

• Certifications such as Splunk Certified Architect, CrowdStrike Certified Falcon Administrator, or Microsoft SC-200.
• Experience integrating detection platforms with SOAR and threat intelligence feeds.
• Familiarity with cloud-native security tools and telemetry (AWS, Azure, GCP).
• Ability to communicate technical concepts to non-technical stakeholders.
• Experience working in regulated industries such as finance or healthcare.

• Ability to travel up to 10% of the time.
• Ability to work in a fast-paced, high-demand environment while balancing multiple priorities.

• Health benefits
• 401(k) Plan
• Paid time off
• Disability benefits
• Life insurance, critical illness insurance, and accident insurance
• Parental leave
• Critical caregiving leave
• Discounts and savings
• Commuter benefits
• Tuition reimbursement
• Scholarships for dependent children
• Adoption reimbursement