Detection and Response Engineer

Responsibilities

• Security Incident Response
• Own escalated security incidents end-to-end, including scoping, evidence collection, threat analysis, containment, and remediation
• Analyze and reverse engineer malware to understand its behavior, extract Indicators of Compromise (IOCs), identify Tactics, Techniques, and Procedures (TTPs), and determine appropriate detection and response
• Conduct threat hunting using existing detection content, threat intelligence, and independent hypothesis-driven analysis
• Review and provide feedback on reported security incidents
• Detection Engineering
• Write, test, and deploy detection rules (YARA-L or equivalent) through the team's CI/CD Detection-as-Code pipeline
• Tune existing detections to reduce false positives, using incident and hunting findings as the primary signal for what needs fixing
• Identify detection gaps surfaced during investigations and translate them into new rule proposals
• Build and maintain SOAR playbooks and security automation, including AI-driven and agentic workflows, to automate alert triage, enrich investigations, and speed up incident response.

Languages