Senior Security Engineer, Detection & Response

Responsibilities

• There is no MSSP and no tier-1 queue here. Detection & Response engineers own their detections end to end: you write them, you tune them, and your team is paged when they fire. The security team is spread across the globe with a follow-the-sun pager rotation so nobody is paged at 3am local.
• The adversaries are real. The business is growing fast and the threat surface is growing with it. Defining the necessary telemetry is part of the job.
• Detection engineering
• Build and tune detections across endpoint, identity, SaaS, and cloud, treating them as software: version-controlled, peer-reviewed, and shipped through the same CI/CD practices the rest of engineering uses.
• Track detection quality as measured quantities: coverage against MITRE ATT&CK, precision, time-to-detect. We don’t build-and-forget here.
• Response & automation
• Own incident response: triage, contain, remediate, and write the retrospective that turns the incident into a systemic fix.
• Build automation that removes toil from investigations, and partner closely with the US-based team so context carries across time zones instead of getting lost at handoff.
• Telemetry & partnership
• Define telemetry requirements for new systems before they ship, working with infrastructure and product teams to close visibility gaps rather than discovering them during an incident.

Languages