Security Engineer, Detection and Response

What you'll do

• Build and tune detections across cloud, identity, endpoint, and SaaS environments, and improve detection lifecycle, measurement, and rollout safety.
• Develop tooling and automation for triage, investigation, enrichment, and detection authoring; translate threat intelligence and adversary TTPs into detections.
• Participate in investigations, incident response, postmortems, metrics tracking, and a shared on-call rotation.

What they ask for

• 3+ years of experience in detection engineering, security operations, incident response, threat hunting, or a closely related security or software engineering role.
• Written or tuned production detections, with attention to signal quality and reducing noise.
• Working knowledge of at least one detection or query language (Sigma, KQL, SPL, YARA-L, EQL, or Panther), or strong SQL or Python skills and willingness to learn one.
• Understanding of attacker behavior and hands-on experience with AWS, GCP, or Azure; experience using SIEM, EDR, or SOAR tools.

Nice to have

• Experience with detection-as-code workflows, large-scale SIEM/EDR/SOAR platforms, or purple-team, blue-team, or adversary-emulation exercises.
• Experience applying LLMs or agent-style tooling to security workflows, securing AI-enabled systems, or Kubernetes/container detection.

Pay

$185,000 - $280,000 per year (base salary)

Tools

Sigma, KQL, SPL, YARA-L, EQL, Panther, SQL, Python

AI focus

Build automation for security workflows, including LLM-based workflows where useful; applying LLMs or agent-style tooling is a nice-to-have.