Senior Security Engineer, Detection Engineering

• Build and tune high-confidence detections across platforms such as Splunk, Microsoft Sentinel / Defender, CrowdStrike, cloud-native logs, identity telemetry, endpoint data, SaaS platforms, and developer systems.
• Translate incidents, hunts, threat intelligence, red-team findings, and vulnerability context into detection logic we can test and operate.
• Investigate real telemetry before we alert on it, including field behavior, timing, joins, baselines, and the false positives a responder will actually see.
• Drive the full detection lifecycle: design, query development, validation, peer review, documentation, deployment, tuning, monitoring, and retirement.
• Strengthen detection-as-code workflows, including test data, quality checks, metadata, rollout safety, coverage tracking, and detection health reporting.
• Partner with responders to cut noise, add useful context, improve severity decisions, and build follow-up detections after investigations.
• Shape logging, normalization, enrichment, and retention requirements when the telemetry we need is missing or hard to use.
• Coach analysts and engineers through design reviews, query reviews, and clear guidance on what makes a detection credible.
• 8+ years of experience in detection engineering, security engineering, threat hunting, incident response, SOC engineering, or information security monitoring.
• A degree in Computer Science, Cybersecurity, Engineering, or equivalent experience
• Hands-on experience building and tuning detections in a major SIEM or security analytics platform.
• Strong query and scripting skills, especially SPL, KQL, SQL, Python, or similar languages used to analyze security telemetry and automate repetitive work.
• Practical understanding of attacker behavior across identity, endpoint, cloud, network, email, collaboration tools, developer infrastructure, secrets, and data theft.
• Ability to move from raw logs to a production-ready detection, including field semantics, thresholds, joins, baselines, false positives, missing data, and triage context.
• Comfortable working with Git, code review, automated checks, CI/CD, documentation, and operational ownership of the content you ship.
• Clear communication and sound judgment. You should be able to explain why a detection matters, what it misses, what we should do next, and when we should choose not to alert.
• You have led or materially improved a detection-as-code program across more than one security platform.
• Background in cloud, identity, Kubernetes, CI/CD, supply-chain, or AI-tooling attack paths well enough to design detections without waiting for a complete recipe.
• Detected abuse in developer systems, package ecosystems, secrets workflows, AI coding tools, agents, bots, or model-serving infrastructure.
• Worked closely with incident response, threat hunting, red team, purple team, malware analysis, or forensics teams.
• Built validation methods such as replay tests, synthetic telemetry, attack emulation, detection unit tests, or coverage reporting.
• You will also be eligible for equity and benefits .
• Applications for this job will be accepted at least until September 13, 2026.
• This posting is for an existing vacancy.

None flagged.