Detection Analyst, Threat Intelligence

Role overview

This role sits within the Global Security Organization, the team responsible for reducing risk and protecting TikTok’s products, users, and business operations at global scale. The group works to keep the platform secure, safeguard user data and experience from both external and internal threats, and support compliance with regulations across the regions where TikTok operates.

The team is seeking a Detection Analyst who enjoys solving security problems through software. The position is highly hands-on and engineering-focused, with responsibility for building the systems, data pipelines, and detection logic that convert threat intelligence into scalable detection capability for internal partners.

This role is suited to someone who is strong in coding, comfortable building production-ready solutions, and motivated by the intersection of threat intelligence, data engineering, and detection development.

What you will do

• Design, implement, and maintain detections that are informed by threat intelligence, attacker behavior, fraud activity, and abuse trends.
• Build reliable, production-grade pipelines and tooling to collect, ingest, normalize, enrich, and deliver data used for detections and investigations.
• Convert threat reports, indicators, and behavioral signals into scalable detection content, enrichment processes, and monitoring logic.
• Evaluate and improve detection effectiveness by measuring performance, tuning logic, lowering false positives, and expanding coverage through iterative analysis.
• Develop internal utilities, scripts, services, workflows, or lightweight applications that help analysts and investigators search, review, and respond to threat data more efficiently.
• Work closely with Threat Intelligence, Security Engineering, Product, and business stakeholders to design, validate, and deploy detection capabilities into production.

Requirements

• Strong software engineering fundamentals and practical coding ability.
• Proficiency in Python and/or Golang for pipelines, automation, APIs, or backend services.
• Proven experience creating maintainable, testable, and production-quality code.
• Experience handling structured and semi-structured data such as logs, event data, and text-based intelligence.
• Working knowledge of SQL, data modeling, and schema design for detection and investigation use cases.
• Interest or background in detection engineering, threat intelligence, security analytics, fraud, abuse, or cybercrime.
• Strong communication skills with the ability to explain technical choices and translate complex security challenges into engineering solutions.
• Preferred: experience with detection pipelines, alerting workflows, or specialized security tooling.
• Preferred: familiarity with threat intelligence concepts, indicators of compromise (IOCs), TTPs, and investigation workflows.
• Preferred: experience with Hive, MongoDB, advanced SQL, and data visualization dashboards.
• Preferred: exposure to distributed systems, workflow orchestration, or large-scale data processing.

About TikTok and the team

TikTok is a leading short-form video platform with a mission to inspire creativity and bring joy. Its global headquarters are in Los Angeles and Singapore, with additional offices in New York City, London, Dublin, Paris, Berlin, Dubai, Jakarta, Seoul, and Tokyo.

The company emphasizes creativity, curiosity, humility, resilience, and an iterative “Always Day 1” mindset. It also states a commitment to diversity and inclusion, aiming to build an environment where people are valued for their skills, experiences, and perspectives.