Security Engineer - Detection and Response

Responsibilities

• Identify detection opportunities, define clear telemetry requirements, and partner with the detection infrastructure squad and data owners to make the signals needed for detection and investigation available.
• Develop, test, tune, and maintain detections across endpoint, identity, cloud, SaaS, email, and other security-relevant environments.
• Investigate and prioritize alerts, determine their security impact, and participate in incident containment and remediation.
• Build repeatable investigation workflows and playbooks for alert triage, evidence collection, decision-making, escalation, containment, and response.
• Improve proactive threat-identification and threat-hunting capabilities using internal telemetry and external threat intelligence.
• Create cutting-edge AI workflows for Detection and Response that enrich alerts, gather and analyze evidence, guide investigations, and automate repetitive response work while preserving appropriate human judgment and oversight.
• Measure detection effectiveness, identify coverage gaps, and tune detections to balance security value, fidelity, and analyst workload.
• Use SIEM, EDR, SOAR, and related security platforms to research threats, develop detections, investigate alerts, and validate security outcomes.
• Share knowledge, document decisions, and communicate security findings clearly to technical and non-technical audiences.

Languages