Continuous AI Red Teaming — test our own defenses at attacker speed (Primary)

• Stand up and operate continuous, automated adversary emulation against production controls, so defensive coverage is proven by evidence on a recurring cadence rather than assumed between annual assessments.
• Use AI to generate and mutate attack behavior — varying tradecraft, tooling, and sequencing across ATT&CK techniques — so detections are tested against variants rather than a single static signature.
• Close the loop from emulation to engineering: every miss becomes a detection backlog item, every noisy hit becomes a tuning task, and every fix is re‑tested automatically.
• Red team our AI itself — test detection models, agents, and prompts for evasion, prompt injection, data poisoning, and unsafe autonomous action, and remediate what you find.
• Operate emulation safely in production: scoped targets, rate limits, clear abort criteria, deconfliction with the response team, and full audit trails for every executed technique.
• Report coverage as a living metric — which techniques are prevented, which are detected, which are only logged, and which are invisible — and use it to prioritize the detection roadmap.

Threat Research & Hunting

• Track adversary tradecraft relevant to CDW and our customers, and translate intelligence into emulation plans, detections, and response actions rather than reading material.
• Run hypothesis‑driven threat hunts across SIEM, XDR, identity, and cloud telemetry, and convert every confirmed hunt technique into an automated detection so the same hunt never has to be run by hand twice.
• Map techniques to controls and automated responses once, then reuse the mapping globally across the estate.
• Lead technical deep dives on significant incidents and emulation findings, and feed the lessons back into detection content, response playbooks, and platform hardening.

Detection Engineering as Code

• Treat detection content as software: version controlled, peer reviewed, unit tested against emulation data and promoted through CI/CD with security gates that block low‑quality logic before it reaches production.
• Develop integrations and tooling in Python against platform APIs and event‑driven architectures, favoring reusable services over one‑off scripts.
• Build detection and response capability that self‑heals — identifying telemetry gaps, sensor degradation, and control drift, then correcting them or rolling back to a known‑good state without waiting for a human.
• Eliminate repeat findings through native auto‑remediation patterns rather than recurring manual cleanup.

Collaboration & Influence

• Partner closely with the Threat Response team, Cyber Defense Engineering, security platform owners, and business unit owners so that detections, emulations, and automated actions land with clear ownership boundaries.
• Contribute to shared backlogs and design reviews, and mentor engineers and analysts on detection quality, adversary tradecraft, and the safe use of AI in the defensive stack.
• Document detection logic, emulation plans, automation patterns, and engineering decisions so the capability survives any single person.

What we expect of you

• Bachelor’s degree and 7+ years of experience in threat detection engineering, threat hunting, incident response, or offensive security, or 11+ years of equivalent experience.
• Hands‑on experience building and tuning detections in SIEM platforms and cloud‑scale security tooling.
• Practical working knowledge of the MITRE ATT&CK framework, including mapping detections and automated responses to techniques.
• Experience with adversary emulation, purple teaming, breach and attack simulation, or penetration testing against production controls.
• Proficiency in Python for production‑grade automation and tooling.
• Experience applying AI/ML or LLM‑based capabilities to security problems, and designing secure, observable, and maintainable AI‑enabled solutions.
• Working experience with security automation, orchestration, or SOAR platforms.
• Built detection and response capability for large, diverse enterprise environments, a plus.
• Familiarity with platforms such as Microsoft Defender, Microsoft Sentinel, CrowdStrike, Tines, Entra ID, and Splunk, a plus.
• Familiarity with emulation and offensive tooling such as Atomic Red Team, Caldera, Cobalt Strike, or commercial breach and attack simulation platforms, a plus
• Detection‑as‑code practice: CI/CD pipelines, infrastructure‑as‑code, policy‑as‑code, and automated testing of detection content, a plus.
• Experience securing or red teaming AI systems, including prompt injection, model evasion, and agent safety testing, a plus
• Relevant certifications (GCIH, GCFA, GCTI, GPEN, OSCP, Azure Security, or cloud and automation certifications), a plus.

Pay range: $137,000 – 190,600 depending on experience and skill set.
Annual bonus target 10% subject to terms and conditions of plan.
Benefits overview:
ranges may be subject to geographic differentials.

CDW is committed to being an AI-fluent organization

Additionally, CDW is committed to fostering an equitable, transparent, and respectful hiring process for all applicants. During our application process, our goal is to understand your experience, strengths, skills, and qualifications. As an AI forward company, we see AI not just as a tool, but as a catalyst for new ways of thinking, creating, and communicating. We encourage candidates to embrace an AI mindset, one that’s curious, adaptive, and ready to explore what’s possible. We welcome thoughtful use of AI to expand your perspective and elevate how you share your story, while ensuring your application remains rooted in your own background, judgment, and voice.

About Us

CDW is a Fortune 500 technology solutions provider that helps businesses, government, education, and healthcare organizations achieve what’s possible through technology. What makes CDW different isn’t just what we do—it’s how we do it. At CDW we act as one—building trust, speaking candidly, and working together to achieve more. We play to win—focusing on what matters most and delivering for our customers. And we think forward—staying curious, moving fast, and continuously learning. We believe meaningful work happens when people feel supported, heard, and empowered to contribute. That’s why we think of ourselves as coworkers, not just employees—working together to solve complex challenges and deliver real impact for our customers and communities.

As a full‑stack, full‑lifecycle technology partner, CDW brings deep expertise, strong relationships, and broad industry knowledge to help turn ideas into outcomes. When you join CDW, you become part of a collaborative environment where your work matters, your growth is supported, and your contributions help shape what’s next.

Together, we deliver the full promise of what technology can do. Together, we Make Amazing Happen.

CDW is an equal opportunity employer. All qualified applicants will receive consideration for employment without regards to race, color, religion, sex, sexual orientation, gender identity, national origin, disability status, protected veteran status or any other basis prohibited by state and local law.     

Originally posted on Himalayas