Security Engineer - Detection and Response

• Identify detection opportunities, define clear telemetry requirements, and partner with the detection infrastructure squad and data owners to make the signals needed for detection and investigation available.

• Develop, test, tune, and maintain detections across endpoint, identity, cloud, SaaS, email, and other security-relevant environments.

• Investigate and prioritize alerts, determine their security impact, and participate in incident containment and remediation.

• Build repeatable investigation workflows and playbooks for alert triage, evidence collection, decision-making, escalation, containment, and response.

• Improve proactive threat-identification and threat-hunting capabilities using internal telemetry and external threat intelligence.

• Create cutting-edge AI workflows for Detection and Response that enrich alerts, gather and analyze evidence, guide investigations, and automate repetitive response work while preserving appropriate human judgment and oversight.

• Measure detection effectiveness, identify coverage gaps, and tune detections to balance security value, fidelity, and analyst workload.

• Use SIEM, EDR, SOAR, and related security platforms to research threats, develop detections, investigate alerts, and validate security outcomes.

• Share knowledge, document decisions, and communicate security findings clearly to technical and non-technical audiences.
  

Who You Are

• You are curious, collaborative, and comfortable making progress in an ambiguous and rapidly changing environment.

• You have 3+ years of hands-on experience in security operations, incident response, threat detection, detection engineering, or closely related work.

• You understand how analysts triage and investigate alerts and how detection quality affects their decisions and workload.

• You know how to create and tune detections based on attacker behavior, available telemetry, and an expected investigation path.

• You are experienced with security platforms such as SIEM, EDR, SOAR, or comparable monitoring and response technologies.

• You can write code or use an automation platform to analyze security telemetry, enrich alerts, build investigation workflows, and remove repetitive work. Experience with Python or a similar language is valuable.

• You understand modern detection-as-code practices, including GitHub, peer review, CI/CD, testing, and safely managing production detection content.

• You have experience working with at least one major cloud platform, such as Google Cloud, AWS, or Azure.

• You understand common threats affecting SaaS-oriented corporate and production environments.

• You care about clear documentation, inclusive collaboration, and explaining security concepts to people with different backgrounds and levels of expertise.

• You are excited to create and critically evaluate cutting-edge AI workflows for detection development, alert triage, security investigations, and response, while applying sound security judgment and appropriate human oversight.