Summary
What you’ll impact
The Senior Detection Engineer owns detection and response across endpoints, identity, cloud workloads, SaaS, and AI systems, hunting, triaging, containing, and resolving security incidents. They build production‑grade detections, threat models, and automated investigation agents using Python, SQL, and AI‑enhanced telemetry pipelines deployed via CI/CD. Coverage is mapped to MITRE ATT&CK, measured for precision and time‑to‑detect, and tuned based on hunting, penetration‑test findings, and adversary emulation. The engineer collaborates with security, engineering, and legal teams, participates in on‑call rotations as incident commander, and leads post‑incident reviews to improve detection speed.
Responsibilities
What you'll do
- This role owns detection and response across the company's corporate and production environments: endpoints, identity, cloud workloads, SaaS, and the AI systems and agents we operate.
- Own detection and response across endpoints, identity, cloud workloads, SaaS, and the company's AI systems. Hunt, triage, investigate, contain, and drive incidents through resolution, then turn what you learn into better detections and controls.
- Build detections as production software on telemetry and pipelines provided by AI & Integrations Engineering. Keep them version-controlled, peer-reviewed, tested, and deployed through CI/CD. Measure coverage, precision, and time to detection, then tune where the data shows a gap.
- Build threat models, telemetry, and response playbooks for our AI systems, agents, and their tool use. Detect misuse of agents operating across the organization.
- Build and supervise agents for triage, enrichment, and investigation. Set guardrails and approval thresholds for containment and other high-impact actions.
- Map coverage to MITRE ATT&CK and validate it through threat hunting, penetration-test findings, and adversary emulation.
- Share the on-call rotation and act as incident commander when security is involved. Engineering owns service reliability; Customer Trust and Legal own customer communications. Run post-incident reviews and use the findings to reduce detection and containment time.
- Investigate insider risk and identity abuse with Corporate Security, People, and Legal. Work with Vulnerability Management on exposure priorities and IT Systems on the underlying estate.
- Track actors and campaigns targeting AI companies and convert the intelligence into hunts and detections. Own the digital-risk platform and coordinate urgent phishing and impersonation takedowns.
Requirements
What you’ll bring
- 5+ years in detection engineering, incident response, or security operations, including work as a senior escalation point. For Staff, we expect roughly 10+ years and experience setting detection and response strategy.
- Strong software engineering skills in Python and SQL. You build detections, automations, and telemetry pipelines that run reliably in production.
- You use LLMs and agents in day-to-day security work and know which decisions require a human. Be ready to show us an investigation or workflow you automated.
- Fluent across endpoint, identity, cloud, and SaaS telemetry. You reason from attacker behaviour and correlate signals across systems.
- You communicate clearly during incidents and turn incomplete technical evidence into sound decisions. Your post-incident reviews lead to concrete changes.